[Replying to both messages]
Emmanuel Dreyfus wrote:
On Fri, Feb 19, 2010 at 07:53:09AM +0100, Emmanuel Dreyfus wrote:
A simple solution in the single master situation is to redirect any SASL
OTP bind to the master. As far as I understand, we have no way of
configuring this right now, it needs at add some code, right?
Perhaps slapo-rwm can do that? Is there a way of matching OTP
binds?
I'm afraid slapo-rwm can't do anything like that, since it is not
involved in SASL binds (not even in rewriting identities).
To go back to your initial statement, redirecting SASL OTP binds to the
master may sound simple, but the question is: is it acceptable? I mean:
isn't it defeating the purpose of using replicas in the first place?
Going a bit technical, we need to let SASL bind know that some mechs may
need to behave differently. But redirecting SASL binds to the master
means playing man-in-the-middle, we'd rather need to have distributed
SASL binds. Not familiar enough with SASL's internals to debate. As
far as I understand, auxprops is the intended method to implement
distributed SASL info storage and thus (try to) support distributed SASL
bind. However, this means that not only slap_auxprop_store() needs to:
- understand it's acting on behalf of a shadow database
- redirect writes to the master
but also
- wait for replication to complete
before authentication can continue.
A totally different approach would be to have auxprop handling,
including reads, redirected to the master. In this latter case, auxprop
info (at least for specific SASL mechs) shouldn't be replicated at all.
p.
