16 reasons to choose OpenDJ

For a client I needed to put in place an LDAP system to be connected with Atlassian Crowd (SSO), after doing a comparison with OpenLDAP (C), Apache DS (Java) and OpenDJ (Java) I decided to go for OpenDJ for several reasons:

1. It is open source released with CDDL 1.0 license; while Apache DS is released with Apache license and OpenLDAP with it is own license.
2. it has worldwide commercial support, some here in Belgium; Apache DS has only one company and OpenLDAP has also it is worldwide support
3. It is a fork of OpenDS like Oracle Unified Directory so you can still find common problems for  both products
4. The project has a clear roadmap, also described in the wiki, also ApacheDS has it.
5. The ForgeRock company provides also another SSO solution (OpenAM), so in case in a future I want to change SSO I can think to use it, while Apache DS no.
6. It comes packaged as ZIP, RPM and DEB, while ApacheDS has a package for each Operating System and OpenLDAP is packaged in many Operating Systems.
7. It has very good documentation with a lot of examples (released in EPUB, HTML, PDF and RTF), while I found the one from ApacheDS  simpler or in progress (HTML , PDF) and the one of OpenLDAP is good (released in HTML and PDF).
8. It has a rich command line tool, while I found the command line of ApacheDS simpler (relying mostly on the Apache Directory Studio or on ldap client).
9. It is shipped with a java client (not web) while Apache DS has a gui based on Eclipse (Directory Studio)
10. it has REST API on top of the ldap protocol, while ApacheDS leaves to SCIM such job; therefore I hope there will be a web interface using the REST API.
11. It supports replication out of the box, also ApacheDS has it, OpenLDAP as well.
12. It seems to have very good performance (almost at OpenLDAP level) at least in comparison to ApacheDS.
13. It has a support for the virtual attribute IsMemberOf, useful to check which groups a user belongs to, while for ApacheDS the feature needs to be still implemented.
14. It has an implementation of the PKCS5S2 (see PBKDF2) which is used by Crowd as default despite the implementation is  different from Crowd and ApacheDS, which OpenLDAP doesn’t have (and some other password schemes as well)
15. The development team uses Continuous Integration practices (by testing against Ubuntu and Windows), also ApacheDS by using the common Apache Jenkins and testing on Ubuntu.
16. The team has coding guidelines providing checkstyle rules, also ApacheDS has some guidelines and OpenLDAP has few

To test the performances, I did an LDAP jmeter script and published on Github, just to say that OpenDJ has it is own tool, and Tsung can also test LDAP server.

I have been working with my brother to change the PBKDF2 implementation so it is almost similar to Crowd and ApacheDS differing for the printing format of the iterations.

Enjoy using OpenDJ !

Advertisement