Support SRV record lookup and failover (rfc2782)

[cperrin88]

To allow higher availability for LDAP, it would be nice if this implementation supported looking up SRV records according to rfc2782.

The lookup would be on

_ldap._tcp_.$HOSTNAME

and would return a list like

_ldap._tcp.example.com. 600 IN  SRV 0 100 389 ldap1.example.com
_ldap._tcp.example.com. 600 IN  SRV 0 100 389 ldap2.example.com
_ldap._tcp.example.com. 600 IN  SRV 0 100 389 ldap3.example.com

These should be tried according to the priority and weight fields. Pages 5 and 6 of rfc2782 explain how te process should work.

Real world use would be for example for Active Directories in a HA setup.

[mtodd]

@cperrin88 is this something that necessarily belongs inside of the client library or is something that can be negotiated externally and then passed into the client library once a host is selected?

[cperrin88]

Yes I think so. It is a standard feature of Active Directory and this is the easiest way to make this centraly available. It is not uncommon for one DC to be down and Switching could be seamless without everyone putting that part in their software.

[javanthropus]

I have created a gem that can assist with this feature request: https://rubygems.org/gems/resolv-srv. The example included with its README file shows one way to use it with net-ldap to perform SRV record lookups, but it would be nicer if this facility were directly integrated into net-ldap. That way the library could more seamlessly switch servers when necessary without the consumer code needing to handle the details.

[jch]

@javanthropus thanks for the link. As valuable as this sounds, I don't have the bandwidth to maintain this. It looks like a straightforward single lib file. As a compromise, I propose adding a section to the readme that links to useful ruby LDAP utilities #220

[javanthropus]

Thanks for adding the reference in the README. Hopefully, others find the library and can make use of it.

I'm not sure what exactly you don't have bandwidth to maintain though. If someone were to provide a PR with minimal changes that enables using this library as an external dependency, would you consider it?

It should be possible to add a single, optional attribute to Net::LDAP providing the domain in which to search that gets passed to Net::LDAP::Connection. If that attribute is set Net::LDAP::Connection would then perform SRV lookups to find servers and try each one in turn until it successfully opens a connection.

[javanthropus]

@jch I actually have a very minimal patch that doesn't introduce any dependency on the resolv-srv library. Instead, I introduced a new attribute named hosts which is an enumerable of host-port pairs that defaults to the values of the existing host and port attributes. Net::LDAP::Connection is provided this enumerable and iterates over it until a connection can be made. Should all attempts fail, an exception is raised containing all accumulated exception messages.

Manual testing works, but before I go adding a bunch of automation, are you interested?

[jch]

I'm not sure what exactly you don't have bandwidth to maintain though. If someone were to provide a PR with minimal changes that enables using this library as an external dependency, would you consider it?

@javanthropus I'm sure it's a valuable feature, but it's not part of the core LDAP spec, and is out of scope for this library. Yes, it would be convenient to have it work out of the box, but having a separate dedicated gem with a maintainer like yourself who is knowledgeable about the feature ensures that it works long term.

[javanthropus]

@jch thanks for the clarification. I believe the solution provided in #223 is better in general since all that is needed there is a list object that responds to the each method and yields host-port pairs. The details of populating that list are removed from net-ldap entirely and allow for people to provide static or randomized lists or even lists created via SRV lookups. Just having the ability to provide a randomized list would be a boon for applications that wish to load balance their LDAP servers better.

Please take a look at #223 and tell me what you think about it. Thanks!