OpenLDAP can be used in conjunction with numerous other applications. These applications can access and usually modify directory service information. If the use of OpenLDAP is planned insufficiently (or not at all), the following problems may occur:

• If the back ends and the associated directives and parameters are selected incorrectly, they will unintentionally influence the functions that OpenLDAP can offer. If, for example, the “back-ldif” back end is used for data storage to avoid the installation of an additional database, only rudimentary functions of the directory service will be available. This will make it impossible to appropriately manage a large number of users or other objects.
• If the use of overlays is poorly planned, operations that are not needed in OpenLDAP may be performed or other functions may be impaired. For instance, access to the directory service can be incorrectly logged or not logged at all if the debug function of the slapd server itself and the auditlog and accesslog overlays are insufficiently planned.
• OpenLDAP can be run in an unsuitable system environment. If a distributed file system such as the Network File System (NFS) is used to store OpenLDAP data, OpenLDAP file functions will not be available. An example of this is the locking function used by many databases, which allows the directory service database to be locked if several users want to access the database in parallel.
• Incompatible versions of one or more applications could access the databases used by OpenLDAP. For example, the LDAPv3 protocol specifications are not met by OpenLDAP without additional extensions. In addition, there can be connection problems with the applications if the wrong version of a program is used that is not compatible with OpenLDAP.

• BSI -

  Copyright by Bundesamt für Sicherheit in der Informationstechnik (https://www.bsi.bund.de/)