2

We have an application which use ldap protocol. We use unboundId library for that

// ldap
implementation("com.unboundid:unboundid-ldapsdk:6.0.9")

We found out that most api calls use dn as argument.

For example:

ldapConnectionPool.getEntry(dn)

But we also found out that dn is not immutable identifier (it could be changed if we move the object from one location to another one or if we rename it (change CN) but it is not good to have mutable identifiers for many reasons. So we started to look for immutable identifier and found out objectGuid.

But the problem here that I can't find any method which allow me to

  1. Get entry by objectGuid

I've found only this way but I am not sure about performance:

SearchRequest searchRequest = new SearchRequest(
                searchBase, 
                SearchScope.SUB, 
                Filter.createEqualityFilter("objectGuid", objectGuid)
        );
  1. Extract objectGuid from creation request:
    LDAPResult addResult = ldapConnectionPool.add(addRequest)

So my question is:

Is it a good idea to use objectGuid as identifier in our application or not ? performance matters.

From the first glance it looks really attractive but looks like library is not designed for that. What do you think ?

gstackoverflow
  • 36,709
  • 117
  • 359
  • 710

1 Answers1

1

That looks fine; performance shouldn't be an issue.

  1. LDAP does not actually have a "get entry by DN" operation in the first place – under the hood, your LDAP client emulates it by performing a search with SearchScope.BASE and with the DN as base. So you're not changing anything in that regard; you had a search returning 1 entry previously, and you have a search returning 1 entry now.

  2. The objectGUID attribute is indexed – the server will optimize the search query into a fast index lookup and will instantly retrieve the matching entry. It doesn't need to actually scan the entire subtree for this.

user1686
  • 13,155
  • 2
  • 35
  • 54
  • Thank you for yor answer. What about retrieving objectGuid from addResult ? `LDAPResult addResult = ldapConnectionPool.add(addRequest)` – gstackoverflow Jul 26 '23 at 14:17
  • You cannot – there's no extra information in 'Add' results; you'll have to make a lookup (search) of the newly added entry by its DN. There are additional "controls" (postRead, in particular) that would make this possible but only some LDAP implementations support them, so it would be possible with OpenLDAP, but not with AD. (If you're adding many entries in batch, keep in mind LDAP supports async requests.) – user1686 Jul 26 '23 at 14:37