Beginning with Windows Server 2003, Active Directory supports VLV searches. Every VLV search request must be accompanied by 2 request controls: the SSS control and the VLV control. However, Active Directory imposes some general criteria on the SSS control:

1. Cannot sort based on more than one sort keys/attributes.
2. Cannot sort based on the “distinguishedName” attribute (presumably Microsoft does not use the “DN” attribute).
3. Cannot sort based on a constructed attribute (presumably an attribute not stored on Active Directory).

Unfortunately, Solaris LDAP clients use 2 sort keys/attributes: “cn” and “uid” in the SSS control. Subsequently, when dumping a container or a naming database, Solaris LDAP clients would receive LDAP_UNAVAILABLE_CRITICAL_EXTENSION.

$ ldaplist passwd
ldaplist: Object not found (LDAP ERROR (12): Unavailable critical extension.)

This issue has been detailed elsewhere, including at utexas.edu. There appear to be at least four solutions:

1. Wait for the fix from Sun Oracle to reach the light of day: this bug was apparently fixed in SNV 144. (I expect the fix is out in Solaris 11 Express now, but have not tested this myself.)
2. Apply the hotfix in Microsoft’s KB886683 to your domain controllers, which will disable VLV.
3. Run separate ADAM instances with VLV disabled, and point your Solaris machines at them instead of directly at your domain controllers. From the blog post linked above, it sounds like the University of Texas chose this route.
4. Use OpenLDAP as a proxy in front of Active Directory; configure your Solaris machines to use the proxies instead of Active Directory servers. This is the solution detailed in this blog post.

Method
I tested on Ubuntu 10.04 here, although adaptation for your chosen OS is probably straightforward.

First, build OpenLDAP; we need several options not included in the default .deb, so we’ll do this from source, with the following “configure” options:

./configure --prefix=/opt/openldap --enable-meta --enable-ldap --enable-rewrite \
--enable-rwm

(You will probably also want to take the extra step of building a package for your OS, to ease configuration management.)

After installing OpenLDAP, edit slapd.conf to proxy to your domain controllers. In this example, we’re pointing the proxies at some older Windows 2003 hosts using the Microsoft Services for Unix (SFU) extensions, so we’ll take this opportunity to make make what Solaris sees closer to RFC 2307-compliant and eliminate the need for attributeMap arguments to ldapclient on the Solaris host:

#
# See slapd.conf(5) for details on configuration options.
# This file should NOT be world readable.
#
include  /opt/openldap/etc/openldap/schema/core.schema
include  /opt/openldap/etc/openldap/schema/cosine.schema
include  /opt/openldap/etc/openldap/schema/inetorgperson.schema
include  /opt/openldap/etc/openldap/schema/nis.schema
include  /opt/openldap/etc/openldap/schema/mssfu30.schema

# Time out connections before the proxied bind drops:
idletimeout 60

pidfile  /var/run/slapd/slapd.pid
argsfile /var/run/slapd/slapd.args

access to dn.base="" by * read
access to dn.base="cn=Subschema" by * read
access to *
 by self write
 by users read
 by anonymous auth

loglevel   256

######################################################
# database definitions
######################################################

database ldap
suffix  "dc=example,dc=com"
uri  "ldap://dc1.example.com ldap://dc2.example.com"
acl-bind bindmethod=simple binddn="cn=ldapproxy,ou=Service Accounts,ou=Users,dc=example,dc=com" credentials=secret

# Do mapping in OpenLDAP, instead of on client, eliminating need for
# AD schema attribute mapping:
overlay rwm
rwm-map attribute       userpassword    msSFU30Password
rwm-map attribute       memberuid       msSFU30MemberUid
rwm-map attribute       gidnumber       msSFU30GidNumber
rwm-map attribute       gecos           name
rwm-map attribute       uid             msSFU30Name
rwm-map attribute       uidnumber       msSFU30UidNumber
rwm-map attribute       homedirectory   msSFU30HomeDirectory
rwm-map attribute       loginshell      msSFU30LoginShell
rwm-map objectclass     posixGroup      group
rwm-map objectclass     posixAccount    user

Walking through this config file line-by-line, not the following (keyed by line number):

3. Make the file owned by user “root”/group “openldap” without “other” read permissions (assuming you’ll be running OpenLDAP as user “openldap” in group “openldap” – adapt as necessary for your site), e.g.:

-r--r----- 1 root openldap 1569 2010-08-04 14:51 slapd.conf

9. We need to add some schema information for the older Microsoft Services for Unix extensions; they’re available in a GitHub Gist.

30-33. Configure the connection to the Active Directory servers. Note in particular that the database type is “ldap” meaning that another LDAP server (AD) is used as the data source, via a proxy. Line 33 is a user in Active Directory to which you bind to the back-end servers as.

37-47. Map the SFU attributes to their RFC 2307 equivalents. Note that you will need to populate msSFU30MemberUid manually – here’s one way to do it.

Other than that, perhaps an init script and a file for /etc/default/slapd (both lightly adapted from the stock Ubuntu “slapd” .deb), and you should be good to go.

References: eldapo: openldap as a pass-through proxy

netapp01> lun show /vol/nexenta01/lun01/lun
        /vol/nexenta01/lun01/lun      10g (10737418240)   (r/w, online, mapped)

nmc@nexenta01:/$ lunsync
Cleanup obsolete (dangling) device links?  Yes
Re-enumerating LUNs... done.

nmc@nexenta01:/$ show lun
LUN ID      Device    Type         Size       Volume     Mounted Attach GUID
c0t0d0      sd0       disk         272.3GB    syspool    no      mega_sas 60024e805102c100118a3fa70ae8937a
c1t0d0      sd128     cdrom        No Media              no      ata    -
c2t5*DDDd0  sd6       disk         10GB                  no      qlc    60a98000486e542f5034577076716469
c2t5*DDDd0  sd4       disk         10GB                  no      qlc    60a98000486e542f5034577076716469
c2t5*DDDd0  sd7       disk         10GB                  no      qlc    60a98000486e542f5034577076716469
c2t5*DDDd0  sd5       disk         10GB                  no      qlc    60a98000486e542f5034577076716469
c3t5*DDDd0  sd3       disk         10GB                  no      qlc    60a98000486e542f5034577076716469
c3t5*DDDd0  sd2       disk         10GB                  no      qlc    60a98000486e542f5034577076716469
c3t5*DDDd0  sd8       disk         10GB                  no      qlc    60a98000486e542f5034577076716469
c3t5*DDDd0  sd1       disk         10GB                  no      qlc    60a98000486e542f5034577076716469
syspo~/swap           zvol         1.0GB      syspool    no

root@nexenta01:/volumes# stmsboot -L
stmsboot: MPXIO disabled
root@nexenta01:/volumes# stmsboot -e -D fp
WARNING: This operation will require a reboot.
Do you want to continue ? [y/n] (default: y)
updating //platform/i86pc/boot_archive
updating //platform/i86pc/amd64/boot_archive
The changes will come into effect after rebooting the system.
Reboot the system now ? [y/n] (default: y)

nmc@nexenta01:/$ lunsync
Cleanup obsolete (dangling) device links?  Yes

Re-enumerating LUNs... done.

nmc@nexenta01:/$ show lun
LUN ID      Device    Type         Size       Volume     Mounted Attach GUID
c0t0d0      sd0       disk         272.3GB    syspool    no      mega_sas 60024e805102c100118a3fa70ae8937a
c1t0d0      sd128     cdrom        No Media              no      ata    -
c2t5*DDDd0  sd6       disk         10GB                  no      qlc    60a98000486e542f5034577076716469
c2t5*DDDd0  sd4       disk         10GB                  no      qlc    60a98000486e542f5034577076716469
c2t5*DDDd0  sd7       disk         10GB                  no      qlc    60a98000486e542f5034577076716469
c2t5*DDDd0  sd5       disk         10GB                  no      qlc    60a98000486e542f5034577076716469
c3t5*DDDd0  sd3       disk         10GB                  no      qlc    60a98000486e542f5034577076716469
c3t5*DDDd0  sd2       disk         10GB                  no      qlc    60a98000486e542f5034577076716469
c3t5*DDDd0  sd8       disk         10GB                  no      qlc    60a98000486e542f5034577076716469
c3t5*DDDd0  sd1       disk         10GB                  no      qlc    60a98000486e542f5034577076716469
syspo~/swap           zvol         1.0GB      syspool    no             -

root@nexenta01:/volumes# stmsboot -L
stmsboot: No STMS devices have been found

netapp01> igroup show -v nexenta01
    nexenta01 (FCP):
        OS Type: solaris
        Member: 21:00:00:aa:bb:cc:dd:ee (logged in on: 0b, 0d, vtic)
        Member: 21:01:00:aa:bb:cc:dd:ee (logged in on: 0b, 0d, vtic)
netapp01> igroup set nexenta01 alua yes
netapp01> igroup show -v nexenta01
    nexenta01 (FCP):
        OS Type: solaris
        Member: 21:00:00:aa:bb:cc:dd:ee (logged in on: 0b, 0d, vtic)
        Member: 21:01:00:aa:bb:cc:dd:ee(logged in on: 0b, 0d, vtic)
        ALUA: Yes

nmc@nexenta01:/$ lunsync -r
Cleanup obsolete (dangling) device links?  Yes
Re-scanning HBAs... done.
Re-enumerating LUNs... done.

nmc@nexenta01:/$ show lun
LUN ID      Device    Type         Size       Volume     Mounted Attach GUID
c0t0d0      sd0       disk         272.3GB    syspool    no      mega_sas 60024e805102c100118a3fa70ae8937a
c1t0d0      sd128     cdrom        No Media              no      ata    -
c4t6*469d0  sd9       disk         10GB                  no      mpxio  60a98000486e542f5034577076716469
syspo~/swap           zvol         1.0GB      syspool    no             -

root@nexenta01:/volumes# stmsboot -L
non-STMS device name                    STMS device name
------------------------------------------------------------------
/dev/rdsk/c3t500A09869657ADDDd0 /dev/rdsk/c4t60A98000486E542F5034577076716469d0
/dev/rdsk/c3t500A09889657ADDDd0 /dev/rdsk/c4t60A98000486E542F5034577076716469d0
/dev/rdsk/c3t500A09888657ADDDd0 /dev/rdsk/c4t60A98000486E542F5034577076716469d0
/dev/rdsk/c3t500A09868657ADDDd0 /dev/rdsk/c4t60A98000486E542F5034577076716469d0
/dev/rdsk/c2t500A09869657ADDDd0 /dev/rdsk/c4t60A98000486E542F5034577076716469d0
/dev/rdsk/c2t500A09889657ADDDd0 /dev/rdsk/c4t60A98000486E542F5034577076716469d0
/dev/rdsk/c2t500A09888657ADDDd0 /dev/rdsk/c4t60A98000486E542F5034577076716469d0
/dev/rdsk/c2t500A09868657ADDDd0 /dev/rdsk/c4t60A98000486E542F5034577076716469d0

Hat Tip to @complex on Twitter.

Reference: Is it possible to use I/O multipathing? How?

Well, perhaps a 64-bit AMI is forthcoming – I think this is still a beta program – and perhaps Sun’s just trying to save us a buck or two, since the cheapest 64-bit EC2 instance is four times as expensive per hour as the cheapest 32-bit instance.

I’d love to have some of the EMC flash gear, but I doubt I’ll ever see this iteration. I work with NetApp storage arrays (at least for this budget cycle…), and from what I understand about the pricing of the EMC kit, it’s targeted way over the head of my employer. So will I see something similar from NetApp? Unfortunately, it doesn’t sound like they’ll have anything out in the near future. A couple years ago, Dave Hitz was almost dismissive of flash, answering “I don’t think so” and “I don’t care” to the question of whether flash would replace disk drives – and he has some good points, mainly that the storage and management layer is ultimately more important than the physical media one uses. More recently, Jay Kidd, NetApp’s chief marketing officer was quoted by ZDNet as saying that flash will become “an integral part” of enterprise storage – but there are no flash product announcements from NetApp that I’m aware of.

Given NetApp’s storage system architecture, this seems particularly unfortunate to me. SSDs seem like they could fit very nicely as a cache device between the controller and the conventional disk drives. I imagine that just a couple SSDs could give a substantial performance boost to an array for a very moderate price. Additionally, I don’t see a reason why NetApp couldn’t allow you to make an aggregate out of a shelf of flash drives for servers that need absolute top speed. Will they do either of these? I hope both, but we’ll have to wait and see.

(With their newly-announced Performance Acceleration Modules, NetApp seems to be acknowledging the value of an additional caching layer, although the PAM is for read performance only.)

Sun’s flash announcement is focused on the use of flash drives in their server hardware. Specifically, according to an Intel Developer Forum presentation, at least one use case Sun is targeting is ZFS, where direct-attached flash would be used in a cache role for specific ZFS reads and writes (in the second-level Adaptive Replacement Cache – L2ARC – and ZFS Intent Log – ZIL -pools – see page 11 of the above slides). The presentation suggests a possible configuration, comparing a hypothetical Sun X4450 with seven 10k RPM SAS drives and one with two SSDs and five 4200 RPM (did they mean 7200 RPM?) SATA drives. For almost the same price, the SSD/SATA system delivers substantially better Read IOPS and slightly better write IOPS.

Which is all good and nice – I do love a slide with reassuring bar graphs – but Sun won’t be shipping servers with flash drives until later this year. Additionally, the support for separating the L2ARC and ZIL is only in OpenSolaris, not Solaris – I haven’t seen word on when it will be backported. I also wonder about what effect single ZIL and L2ARC drives, as used in the scenario in the presentation, would have on a machine’s availability; Sun could presumably address this with some “best practices” documentation by the time they ship servers with SSDs. All that aside, I like what I see from Sun so far, particularly that they’ve found a use case for SSDs at a reasonable price point.