For a large enterprise deployment of LDAP I used OpenLDAP over 389DS/RHDS/FreeIPA because it was straight-forward and solved the problems of a multi-master and

For a large enterprise deployment of LDAP I used OpenLDAP over 389DS/RHDS/FreeIPA because it was straight-forward and solved the problems of a multi-master and slave-to-each-master architecture well. The initial deployment used Sun Directory Server Enterprise Edition (Sun DSEE, now Oracle DSEE) but when Oracle bought Sun we had conversations with Oracle's product team where they explicitly stated that going forward Sun DSEE would be discontinued and replaced by Oracle's competing (but from our perspective, inferior) product. Contrary to most of the posters here I had no significant trouble figuring out OpenLDAP and found the documentation complete. The main pain points I ran into were: - OpenLDAP was trying to move configuration inside the DIT, which made system administration harder - I ran into some bugs with MDB on Solaris/UltraSPARC before it was officially announced - I ran into some bugs, which the OpenLDAP team fixed In a later job, I was supporting a customer who purcashed RedHat Directory Services (RHDS) and therefore they wanted to use this in preference to OpenLDAP, but it conveyed no advantages, and had worse characteristics and licensing requirements with regards to multi-master replication. The reason the customer purchased RHDS was because their "Solution Architect" team thought they could use it to integrate with Active Directory authentication. However, RHDS's integration mechanism required that something be installed on all Active Directory servers (of which there were around 200, managed by various other companies) this plan was not feasible. Instead, I created a PAM module and used RHDS's "pam_tally" to pass through authentication attempts. This was not as good as could be done on OpenLDAP, however, because pam_tally creates a lock in RHDS and no authentication could happen while it was authenticating -- leading to a few nation-wide lockouts while I figured this undocumented feature out.