LDAP & OUD Directory Services
Relevant source files
The following files were used as context for generating this wiki page:
The LDAP & OUD Directory Services in the FLEXT ecosystem provide a standardized infrastructure for managing directory-based authentication, authorization, and data migration. This system supports multiple directory server types, including generic OpenLDAP and Oracle Unified Directory (OUD), to facilitate testing and production-like environments for packages such as flext-ldap and flext-tap-ldap.
The services are architected around centralized Docker configurations and automated setup scripts that ensure consistency across development and testing lifecycles. This infrastructure is critical for OUD migration workloads, simulating production environments with specific schema behaviors and hierarchy structures.
Sources: docker/README.md:113-134, docker/docker-compose.openldap.yml:1-5
Core Infrastructure Components
FLEXT utilizes three primary container types to support directory service requirements: Generic OpenLDAP, FLEXT OUD (production simulation), and Generic OUD Test.
Container Service Matrix
| Container Type | Primary Port | Purpose | Source File |
|---|---|---|---|
| Generic OpenLDAP | 3390 | Generic LDAP/LDIF testing for flext-ldap and flext-tap-ldap. | docker/README.md:131-134 |
| FLEXT OUD | 3389 | Production-simulated OUD migration (OpenLDAP simulating OUD). | docker/README.md:124-129 |
| Generic OUD Test | 3489 | Generic OUD validation testing with OUD-specific binaries. | docker/docker-compose.flext-oud-test.yml:1-12 |
Service Relationship Diagram
The following diagram illustrates the relationship between the centralized Docker management and the specific directory service containers.
Oracle Unified Directory (OUD) Configuration
OUD instances within FLEXT are configured to mimic production environments, specifically focusing on schema flexibility and structural object class behavior.
Initialization and Setup
The setup-flext-oud.sh script automates the creation of an OUD instance, configuring basic parameters such as the Root User DN (cn=Directory Manager) and the Base DN (default: dc=network,dc=invaliddc).
Sources: docker/images/scripts/setup-flext-oud.sh:9-30
Production-Like Tuning
For testing compatibility with enterprise OUD deployments, the configure-oud-for-testing.sh script applies four critical global configuration properties:
- Single Structural Objectclass Behavior: Set to
acceptto allow entries with multiple structural classes. - Compact Encoding: Disabled for the
userRootworkflow. - Schema Checking: Disabled to allow migration compatibility.
- Unauthenticated Requests: Allowed to facilitate internal testing.
Sources: docker/images/scripts/configure-oud-for-testing.sh:28-60
ACL Processing and Server Detection
The FLEXT ecosystem includes advanced logic for processing Access Control Lists (ACLs) across different directory server types. This is implemented using a railway-oriented pattern to handle validation and extraction concurrently.
Server Type Signatures
The system auto-detects server types by searching for specific attribute signatures in LDAP entries.
| Server Type | Signature Attributes | ACL Attributes |
|---|---|---|
| OpenLDAP | olcAccess, olcACL | olcAccess |
| Oracle OID | orclACI, orclACL | orclACI |
| Oracle OUD | ds-cfg-global-aci, aci | aci, ds-cfg-global-aci |
| Active Directory | ntSecurityDescriptor | ntSecurityDescriptor |
Sources: examples/acl_processing_example.py:84-100
ACL Validation Logic Flow
The validation pipeline evaluates permissions and identifies violations based on server-specific rules.
LDAP Directory Hierarchy
The standard FLEXT OUD setup initializes a specific base hierarchy to support development and testing:
cn=Users,$BASE_DN: Primary container for user entries.cn=PERFIS,$BASE_DN: Container for profile/role entries.ou=especial,cn=Users,$BASE_DN: Organizational unit for system/special accounts.
Sources: docker/images/scripts/setup-flext-oud.sh:56-75
Default Test Users
| DN | Object Classes | Purpose |
|---|---|---|
cn=ORCLADMIN,$BASE_DN | inetOrgPerson, person | Administrative test user. |
cn=FLEXTDEPLOY,... | inetOrgPerson, top | Deployment service account. |
Sources: docker/images/scripts/setup-flext-oud.sh:81-105
Summary
The LDAP & OUD Directory Services provide a robust, containerized environment for directory operations. By centralizing OUD and OpenLDAP configurations and utilizing automated setup scripts, FLEXT ensures that directory interactions—including complex ACL processing and schema-dependent migrations—are validated against production-like environments during the development lifecycle. This system integrates directly with the flext_tests fixture library to provide "clean-slate" containers for every test execution.
Sources: docker/README.md:144-155, docker/images/scripts/configure-oud-for-testing.sh:62-66