Does Jans support multiple databases - split configuration and identity data for example

[johnlister]

As the subject implies. Is it possible to use LDAP as the persistence mechanism for identity information and another database (PostgreSQL for example) for configuration (or session storage, etc)?

It appears all entities are stored in the same "database".

[ossdhaval]

Hi @johnlister

I believe this is not possible. I am tagging @yuriyz for confirmation.

As a side note, if you have an external identity store (LDAP/KeyCloak), you can use Jans Link to connect them to your Janssen Server instance and continue to use them as your identity store.

[yuriyz]

It is better to ask @yurem jans-orm related question.

[ossdhaval]

Tagging @johnlister

[johnlister]

Thanks @nynymike we have our own production hardened LDAP clusters. For performance reasons they are split into multiple clusters, each configured for different use cases/load. In an ideal world we could leave them as is if we migrated to Jans.

[nynymike]

And your hardened LDAP replication clusters are better then RDBMS alternatives? Does't your organization also have an RDBMS service?

[johnlister]

We have maintained the LDAP clusters over many years, they are multi master write capable and can be scaled up or down easily. So yes, I'd argue that they are as good if not better than an RDBMS for this use case. Modern cloud based RDBMS may offer some benefits, but whilst cloud hosted DBs, etc work for many smaller organisations there are multiple caveats that apply where managing your own can be beneficial especially to large organisations.
We could use a cloud RDBMS (and we do use them for other use-cases) but we would have to migrate all of our data across whilst also keeping the service up 24/7 during the migration/switchover.

[nynymike]

As the subject implies. Is it possible to use LDAP as the persistence mechanism for identity information and another database (PostgreSQL for example) for configuration (or session storage, etc)?

No.

[nynymike]

[nynymike]

We are patching this version of OpenDJ, but it seems to always be the problem child. Also, we are not LDAP database programmers. Sometimes we add new algorithms for password hashing... but we don't do much other then patch. Also deploying LDAP in Kubernetes is too much work.

[nynymike]

The answer is no.