search

myOmikron / mailcow-ldap-sync

26 stars 2 forks source link

How to track openldap attribute change? #8

Closed samwell-ho closed 2 years ago

samwell-ho commented 2 years ago

I installed mailcow and openldap, they work great.

However, I have to use crontab to sync at intervals, for example every 15 minutes.

My OpenLDAP database is quite large, each sync can take up to minutes.

The question is "Is there a way to track the change on OpenLDAP and only sync when there is a change?"

I have tried monitoring all OpenLDAP database files but when there is a change (e.g. user changes password), nothing happens.

How to track OpenLDAP attribute change?

This is not an issue but a tip to improve the efficiency of the application, do you know how to do it?

myOmikron commented 2 years ago

Crontab is the intended way of running this script, as users can change their password in mailcow. If I'd only check if there's a change between LDAP and the local database, there would be inconsistent state between LDAP and mailcow. And as there's no way (which is good) of receiving the user's hash through mailcow's API, all users have to be synced, to update the password on mailcow's side.

Regarding your question: You don't have to check your local LDAP files, as LDAP by itself is intended to be fast in read operations. So even when having a large database, it should be quite fast to retrieve all necessary data. The slow part is surly the communication with mailcow's API.

samwell-ho commented 2 years ago

I agree with you.

However, it is more optimal to only sync data when there is a change instead of using cron periodically.

Is there a way to sync only when an LDAP change is detected. Normally, with a stable system, mainly users edit his/her profiles such as changing passwords, personal information,....

Using crontab will cause unnecessary synchronization times.

Moreover, if the user changes the password for example. He/she has to wait until the next sync (by cron) for the change to take effect.

I tried OpenLDAP's data file monitoring solution with file-watcher. Assuming a change is detected, file-watcher will trigger mailcow-ldap-sync instead of using cron. However it doesn't work because the change cannot be detected on OpenLDAP.

myOmikron commented 2 years ago

As far as I know, openldap does not have any option to trigger such hooks.

You could use a script, which queries the LDAP periodically and executes the mailcow-ldap-sync if it detects a change.

But this is beyond the scope of this project.