cyberleon95, profile picture
Uploaded bycyberleon95
PDF, PPTX4,975 views

LDAP Theory

The document discusses LDAP theory and management. It provides an overview of LDAP including what it is, how it works, and common applications. It also covers topics such as namespaces, schemas, replication, LDIF, and management of LDAP directories. The document is intended as training material for an LDAP conference presentation.

Download as PDF, PPTX
1 / 142
2 / 142
3 / 142
4 / 142
5 / 142
6 / 142
7 / 142
8 / 142
9 / 142
10 / 142
11 / 142
12 / 142
13 / 142
14 / 142
15 / 142
16 / 142
17 / 142
18 / 142
19 / 142
20 / 142
21 / 142
22 / 142
23 / 142
24 / 142
25 / 142
26 / 142
27 / 142
28 / 142
29 / 142
30 / 142
31 / 142
32 / 142
33 / 142
34 / 142
35 / 142
36 / 142
37 / 142
38 / 142
39 / 142
40 / 142
41 / 142
42 / 142
43 / 142
44 / 142
45 / 142
46 / 142
47 / 142
48 / 142
49 / 142
50 / 142
51 / 142
52 / 142
53 / 142
54 / 142
55 / 142
56 / 142
57 / 142
58 / 142
59 / 142
60 / 142
61 / 142
62 / 142
63 / 142
64 / 142
65 / 142
66 / 142
67 / 142
68 / 142
69 / 142
70 / 142
71 / 142
72 / 142
73 / 142
74 / 142
75 / 142
76 / 142
77 / 142
78 / 142
79 / 142
80 / 142
81 / 142
82 / 142
83 / 142
84 / 142
85 / 142
86 / 142
87 / 142
88 / 142
89 / 142
90 / 142
91 / 142
92 / 142
93 / 142
94 / 142
95 / 142
96 / 142
97 / 142
98 / 142
99 / 142
100 / 142
101 / 142
102 / 142
103 / 142
104 / 142
105 / 142
106 / 142
107 / 142
108 / 142
109 / 142
110 / 142
111 / 142
112 / 142
113 / 142
114 / 142
115 / 142
116 / 142
117 / 142
118 / 142
119 / 142
120 / 142
121 / 142
122 / 142
123 / 142
124 / 142
125 / 142
126 / 142
127 / 142
128 / 142
129 / 142
130 / 142
131 / 142
132 / 142
133 / 142
134 / 142
135 / 142
136 / 142
137 / 142
138 / 142
139 / 142
140 / 142
141 / 142
142 / 142
LDAP Theory and Management Brad Marshall brad.marshall@member.sage-au.org.au SAGE-AU Conf 2003 – p. 1
Contents What is LDAP? Directory services LDAP Models Namespaces Schema Replication LDIF and DSML Search Filters LDAP Protocol SAGE-AU Conf 2003 – p. 2
Contents cont Directory Life Cycle Directory Management Namespace Design Topology Design Replication Design Management Models Data Maintanence Metadirectories Virtual directories SAGE-AU Conf 2003 – p. 3
History of LDAP Originally started as a front end to X.500 Provides much of X.500’s functionality at a lower implementation cost Removed redundant and rarely used operations Uses TCP rather than OSI stack University of Michigan wrote first LDAP implementation Most early LDAP implementations were based on it U.Mich eventually realized didn’t need X.500 and wrote lightweight server Meant it was easier to deploy, and more people started using it SAGE-AU Conf 2003 – p. 4
What is LDAP? LDAP = Lightweight Directory Access Protocol Stanard protocol that can be used to access information over a network Based on X.500 Directory Service Described in RFC1777 and RFC2251 Stores attribute based data SAGE-AU Conf 2003 – p. 5
What is LDAP cont Data generally read more than written to No transactions No rollback Client-server model Based on entries Collection of attributes Globally unique distinguished name (DN) - like domain name Entries arranged in hierarchical tree structure SAGE-AU Conf 2003 – p. 6
Directory Services Directories are a specialized database Used in everyday lives - phone book, TV guides, etc Everyday directories fairly static Online directories are dynamic, flexible, secure and can be personalized Examples of online directories are finger, DNS, NIS and unix password file SAGE-AU Conf 2003 – p. 7
Why use LDAP Centrally manage users, groups and other data Don’t have to manage separate directories for each application - stops the “N + 1 directory problem” Distribute management of data to appropriate people Allow users to find data that they need Not locked into a particular server Ability to distribute servers to where they are needed Standards available for sharing data SAGE-AU Conf 2003 – p. 8
What LDAP can do Find things - local office phone book, Internet directories such as Four11, BigFoot etc Manage things - users and groups. Removes “N + 1” directory problem Lightweight database applications - sort bookmarks, small bits of data Security - store username and passwords, digital certificates, PKI etc SAGE-AU Conf 2003 – p. 9
What LDAP can’t do LDAP isn’t a relational database No rollback for failed operations LDAP isn’t a filesystem No locking or seeking Can’t search blobs of data LDAP isn’t good for dynamic objects Optimized for read, not write No locking to ensure transactions occur in a certain order - corruption could occur No generic SQL-like reporting language Not useful without applications SAGE-AU Conf 2003 – p. 10
LDAP vs Databases Read-write ratio - LDAP is read optimized Extensibility - LDAP schemas are more easily changed Distribution - with LDAP data can be near where it is needed, and highly distributed Replication - with LDAP data can be stored in multiple locations Different performance - directories used for many different applications, and queries are usually simpler, but many more of them Data sharing - LDAP is designed for sharing data, databases designed for one application SAGE-AU Conf 2003 – p. 11
LDAP vs Databases cont Database objects have complex relationships Transaction model - LDAP transactions are simple - usually changing one entry, databases can modify much more Size of information - LDAP is better at storing small bits of information Type of information - LDAP stores information in attributes Naming model - LDAP is hierachical Schemas - database schemas are entirely user defined, directories have core schemas to help interoperability Standards are more important for directories - LDAP clients can talk to any LDAP server, but database client can only talk to the database it was designed for SAGE-AU Conf 2003 – p. 12
LDAP vs NIS Uses arbitrary ports No data encryption No access-control mechanism Uses a flat (non scalable) namespace Uses a single-key database (providing only basic searching abilities) All changes had to be made by the superuser on the domain master Does not provide directory services for non name service applications No ability for clustering (slapd replication and round robin DNS for LDAP) SAGE-AU Conf 2003 – p. 13
X.500 Designed by International Telecom Union (ITU) and International Organization for Standards (ISO) First designed in 1988 First general purpose directory system Designed to be extensible - rich search operations Open standard Relies on large suite of protocols Early implementations buggy and slow Based on OSI network protocols, not TCP/IP SAGE-AU Conf 2003 – p. 14
LDAP Directory Services Two general types of directory servers: Stand alone LDAP servers LDAP is only access mechanism Data stores tuned for LDAP LDAP gateway servers Translate betwen LDAP and some other protocol Original use of LDAP - gateway to X.500 Doesn’t really matter where data is stored, as long as it is accessible via LDAP SAGE-AU Conf 2003 – p. 15
Common LDAP Applications White pages Authentication and authorization Personalization Roaming profiles Public Key Infrastructure (PKI) Message delivery SAGE-AU Conf 2003 – p. 16
LDAP Models Information Model - defines the types of data and basic units of info stored in directory Naming Model - defines how to organise and refer to the data Functional Model - defines operations in LDAP protocol Security Model - defines framework for protecting information SAGE-AU Conf 2003 – p. 17
Acronyms Acronym Definition LDAP Lightweight Directory Access Protocol DN Distinguish Name RDN Relative Distinguished Name DIT Directory Information Tree LDIF LDAP Data Interchange Format DSML Directory Services Markup Language OID Object Identifier SAGE-AU Conf 2003 – p. 18
Namespaces Hierarchical data structure Entries are in a tree-like structure called Directory Information Tree (DIT) Consistent view of data - uniform namespace Answers request Refer to server with answer SAGE-AU Conf 2003 – p. 19
Namespaces - Hierarchal dc=com dc=pisoftware ou=People ou=Group uid=bmarshal uid=jparker cn=dev cn=sysadmin SAGE-AU Conf 2003 – p. 20
Namespaces - Flat dc=com dc=pisoftware uid=bmarshal uid=jparker ... SAGE-AU Conf 2003 – p. 21
Namespaces cont Directory tree is similar to unix file system No root entry in ldap Each entry in ldap can both contain data and be a container In unix, an entry is either a file or a directory - not both LDAP distinguished names are read from bottom to top, unix file systems from top to bottom SAGE-AU Conf 2003 – p. 22
Namespaces cont / usr local bin X11R6 bin sshd lib dc=com dc=pisoftware ou=People ou=Sysadmin ou=Group cn=dev uid=bmarshal dc=sun SAGE-AU Conf 2003 – p. 23
Global View LDAP Server 1 LDAP Server 2 LDAP Server 3 Note each server must contain a subtree SAGE-AU Conf 2003 – p. 24
Distinguished Names Defined in RFC2253 “Lightweight Directory Access Protocol (v3): UTF-8 String Representation of Distinguished Names” Built up by starting at the bottom, and connecting each level together with commas Contain two parts Left most part is called relative distinguished name Remainder is base distinguished name Eg: uid=bmarshal,ou=People,dc=pisoftware,dc=com RDN is uid=bmarshal Base DN is ou=People,dc=pisoftware,dc=com SAGE-AU Conf 2003 – p. 25
Distinguished Names cont In each base DN, each RDN is unique This ensures no two entries have the same DN dc=com dc=pisoftware dc=sun ou=Peopleou=People Same RDN SAGE-AU Conf 2003 – p. 26
LDAP Entry Entries are composed of attributes Attributes consist of types with one or more values Type describes what the information is Value is the actual information in text format Attributes have a syntax which specifies what type of data - see Schema later on SAGE-AU Conf 2003 – p. 27
Referrals 1 2 3 4 LDAP Server 1 LDAP Server 2 1. Client requests information 2. Server 1 returns referral to server 2 3. Client resends request to server 2 4. Server 2 returns information to client SAGE-AU Conf 2003 – p. 28
Aliases Aliases are used to point one LDAP entry to another Allows you to have structures that aren’t hierarchal Similar in sense to using a symlink in unix Not all LDAP servers support aliases - big performance hit SAGE-AU Conf 2003 – p. 29
Aliases cont Created by: Entry with object class of alias Attribute named aliasedObjectName that points to DN of the alias Can use either referrals or putting a LDAP url in an entry SAGE-AU Conf 2003 – p. 30
Schema Set of rules that describes what kind of data is stored Helps maintain consistency and quality of data Reduces duplication of data Ensures applications have consistent interface to the data Object class attribute determines schema rules the entry must follow SAGE-AU Conf 2003 – p. 31
Schema cont Schema contains the following: Required attributes Allowed attributes How to compare attributes Limit what the attributes can store - ie, restrict to integer etc Restrict what information is stored - ie, stops duplication etc SAGE-AU Conf 2003 – p. 32
Objectclass Used to group information Provides the following rules: Required attributes Allowed attributes Easy way to retrieve groups of information Entries can have multiple object classes Required and allowed attributes are the union of the attributes of each of the classes SAGE-AU Conf 2003 – p. 33
Objectclass inheritance Object classes can be derived from others Extends attributes of other objectclass No multiple inheritance Can’t override any of the rules Special class called top - all classes extend Only required attribute is objectclass Ensures all entries have a objectclass SAGE-AU Conf 2003 – p. 34
Attributes Attributes have: Name - unique identifier, not case sensitive Object identifier (OID) - sequence of integers separated by dots Attribute syntax: Data attributes can store - eg integer, string etc How comparisons are made If multi valued or single valued SAGE-AU Conf 2003 – p. 35
Attribute Abbreviations See RFC2256 uid User id cn Common Name sn Surname l Location ou Organizational Unit o Organization dc Domain Component st State c Country SAGE-AU Conf 2003 – p. 36
Replication Replication is method used to keep copy of directory data on multiple servers Increases: Reliability - if one copy of the directory is down Availability - more likely to find an available server Performance - can use a server closer to you Speed - can take more queries as replicas are added Temporary inconsistencies are ok Having replicas close to clients is important - network going down is same as server going down Removes single point of failure SAGE-AU Conf 2003 – p. 37
Replication Options - Mods to Master LDAP Client Modifications Searches LDAP master (read/write) LDAP slave (read only) Updates replica SAGE-AU Conf 2003 – p. 38
Replication Options - Referrals LDAP Client LDAP slave (read only)1 2 3 4 5 LDAP master (read/write) 1. Client sends modification to replica 2. Replica returns referral of master to client 3. Client resubmits modification to master 4. Master returns results to client 5. Master updates replica with change SAGE-AU Conf 2003 – p. 39
Replication Options - Chaining 1 23 4 5 LDAP Master LDAP Slave Client 1. Client sends modification to replica 2. Replica forwards request to master 3. Master returns result to replica 4. Replica forwards result to client 5. Master updates replica SAGE-AU Conf 2003 – p. 40
Replication - Single Master Single master Single server with read-write copy of data Use read-only replicas to handle load of reading and searching Uses referrals or chaining to deal with mods being sent to replicas Obvious single point of failure Simplest to implement SAGE-AU Conf 2003 – p. 41
Replication - Floating Master Floating master Only one server with writeable copy of data at any time If master becomes unavailable, new master is chosen from remaining servers Actual alogorithm used depends on server - usually voting SAGE-AU Conf 2003 – p. 42
Replication - Cascading Cascading replication Master replicates to hub which replays updates to futher servers Helps balance very heavy loads - master can be used for all writes, and pass off all replication to hub Can replicate out to local hubs in geographically disperse topologies - reduces cost Increase performance - put all reads on “bottom” servers SAGE-AU Conf 2003 – p. 43
Replication - Fractional Fractional replication Replicates subsets of attributes Useful for synchronizing from intranet to extranet and removing data for security reasons Can help reduce replication costs by removing unneeded data SAGE-AU Conf 2003 – p. 44
Replication - Multi-master Multi-master More than one server with writable copy of data Servers are responsible for ensuring data propogates Need a conflict resolution policy - most current servers use a last writer wins policy Can have automatic failover when one is unavailable Most complex to implement SAGE-AU Conf 2003 – p. 45
LDIF LDAP Data Interchange Format Represents LDAP entries in text Human readable format Allows easy modification of data Useful for doing bulk changes dump db, run a script over, import back Can use templates for additions Good for backups and transferring data to another system SAGE-AU Conf 2003 – p. 46
LDIF Cont If attribute contains non-ascii chars, begins with a space, colon or less than, the value is stored in base64 and type separator is :: Can mix plain text and encoded values Can specify URLs, type separator is :< Entries in LDIF are separated with a blank line Continued lines start with spaces Utilities to convert from database to ldif and back slapcat: ldbm database to ldif slapadd: ldif to ldbm database Few non-LDAP related servers know how to deal with it SAGE-AU Conf 2003 – p. 47
LDIF Example dn: uid=bmarshal,ou=People, dc=pisoftware,dc=com uid: bmarshal cn: Brad Marshall objectclass: account objectclass: posixAccount objectclass: top loginshell: /bin/bash uidnumber: 500 gidnumber: 120 homedirectory: /mnt/home/bmarshal gecos: Brad Marshall,,,, userpassword: {crypt}lDIOnUp17x2jc SAGE-AU Conf 2003 – p. 48
DSML XML-based file format Can store both schema and data Can use as generic import/export format for directory data Many existing servers can deal with XML More complex than LDIF Not all LDAP servers support it SAGE-AU Conf 2003 – p. 49
DSML Example <dsml:dsml xmlns:dsml="http://www.dsml.org/DSML"> <dsml:directory-entries> <dsml:entry dn="uid=bmarshal,dc=example,dc=com" <dsml:objectclass> <dsml:oc-value>top</dsml:oc-value> <dsml:oc-value>account</dsml:oc-value> </dsml:objectclass> <dsml:attr name="cn"> <dsml:value>Brad Marshall</dsml:value> </dsml:attr> <dsml:attr name=loginShell> <dsml:value>/bin/bash</dsml:value> </dsml:attr> </dsml:entry> </dsml:directory-entries> </dsml:dsml> SAGE-AU Conf 2003 – p. 50
Search Filters Consists of: Base and scope - what part to search Filter - what criteria attributes must fulfill to be returned Attributes - what attributes to return Prefix notation Standards RFC 1960: LDAP String Representation of Search Filters RFC 2254: LDAPv3 Search Filters SAGE-AU Conf 2003 – p. 51
Search Filters Operators Basic filter types Presence Equality Substring Greater-than or equal Less-than or equal Approximate Extensible Joining filters & and | or ! not SAGE-AU Conf 2003 – p. 52
Search Filter Details Presence Simple checks for presence of attribute Can return everything by using (objectClass=*) Equality Checks for entries containing given attribute and value Most commonly used search Fastest and easiest to index Case sensitivity depends on attribute syntax SAGE-AU Conf 2003 – p. 53
Search Filter Details cont Substring matching Returns entries with values matching given substrings Useful for finding information, eg in white pages etc Not wildcard or regular expression matching Restricted to matching start, middle or end of strings Slower than presence or equality Middle substring matches slower than start or end SAGE-AU Conf 2003 – p. 54
Search Filter Details cont Ordered matching (greater-than, less-than) Order determined by attributes syntax and matching rules Approximate filter Algorithm used determined by server Common to have soundex Extensible Allows applying an explicit matching rule to a search filter Not very common, but powerful SAGE-AU Conf 2003 – p. 55
Search Filters Examples (objectclass=posixAccount) (cn=Mickey M*) (|(uid=fred)(uid=bill)) (&(|(uid=jack)(uid=jill))(objectclass=posixAccount)) SAGE-AU Conf 2003 – p. 56
Search Scope 3 types of scope: base limits to just the base object onelevel limits to just the immediate children sub search the entire subtree from base down SAGE-AU Conf 2003 – p. 57
Base Scope SAGE-AU Conf 2003 – p. 58
One Level Scope SAGE-AU Conf 2003 – p. 59
Subtree Scope SAGE-AU Conf 2003 – p. 60
Optimizing Searches Index commonly accessed attributes and appropriate filters Reduce opening and closing connections Only request attributes you need Limit the search scope if possible Minimize number of searches - combine searches into one, if possible Minimize updates - writes are slow Use replicas / high availability techniques on the server SAGE-AU Conf 2003 – p. 61
Operational Attributes Attributes used by server that usually aren’t displayed Vary by directory vendor Usually time stamps, server access controls, admin information, last updated dates etc SAGE-AU Conf 2003 – p. 62
Extending Schema To extend schemas, the process is as follows: Obtain Object Identifier (OID) Choose name prefix Create local schema file Define custom attribute types (if necessary) Define custom object classes (Note these examples are from OpenLDAP, others should be similar) SAGE-AU Conf 2003 – p. 63
Obtaining OID OIDs found in protocols described by ASN.1, eg SNMP OIDs are hierachical Do not just arbitrarily pick an OID OIDs are obtained from IANA, under Private Enterprise arc at no cost OID from IANA will be something like 1.3.6.1.4.1.X For experiments, OID 1.1 is available (regarded as dead namespace) SAGE-AU Conf 2003 – p. 64
Choose name prefix Schema elements all have names Names should be descriptive and not likely to clash Convention is to prefix names with few letters to localize the changes The smaller the organization, the longer the prefix should be Examples are auFirm (Aust company) or comPisoftware (elements for pisoftware.com) SAGE-AU Conf 2003 – p. 65
Attribute Types and Object Classes attributetype directive used to define new attribute types Uses Attribute Type Description, as per RFC2252 objectclasses directive used to define new object class Uses Object Class Description, as per RFC2252 SAGE-AU Conf 2003 – p. 66
Attribute Type Description AttributeTypeDescription = "(" whsp numericoid whsp ; AttributeType identifier [ "NAME" qdescrs ] ; name used in ; AttributeType [ "DESC" qdstring ] ; description [ "OBSOLETE" whsp ] [ "SUP" woid ] ; derived from this ; other AttributeType [ "EQUALITY" woid ; Matching Rule name [ "ORDERING" woid ; Matching Rule name [ "SUBSTR" woid ] ; Matching Rule name SAGE-AU Conf 2003 – p. 67
Attribute Type Description cont [ "SYNTAX" whsp noidlen whsp ] [ "SINGLE-VALUE" whsp ] ; default multi-valued [ "COLLECTIVE" whsp ] ; default not collective [ "NO-USER-MODIFICATION" whsp ] ; default user modifiable [ "USAGE" whsp AttributeUsage ] ; default userApplications whsp ")" AttributeUsage = "userApplications" / "directoryOperation" / "distributedOperation" / "dSAOperation" SAGE-AU Conf 2003 – p. 68
Attribute Type Example attributetype ( 2.5.4.41 NAME ’name’ DESC ’names associated with the object’ EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{32768} ) attributetype ( 2.5.4.4 NAME ( ’sn’ ’surname’ ) DESC ’surnames associated with the object’ SUP name ) SAGE-AU Conf 2003 – p. 69
Object Class Description ObjectClassDescription = "(" whsp numericoid whsp ; ObjectClass identifier [ "NAME" qdescrs ] [ "DESC" qdstring ] [ "OBSOLETE" whsp ] [ "SUP" oids ] ; Superior ObjectClasses [ ( "ABSTRACT" / "STRUCTURAL" / "AUXILIARY" ) whsp ] ; default structural [ "MUST" oids ] ; AttributeTypes [ "MAY" oids ] ; AttributeTypes whsp ")" SAGE-AU Conf 2003 – p. 70
Object Class Example objectclass ( 1.3.6.1.1.1.2.0 NAME ’posixAccount’ SUP top AUXILIARY DESC ’Abstraction of an account with POSIX attributes’ MUST ( cn $ uid $ uidNumber $ gidNumber $ homeDirectory ) MAY ( userPassword $ loginShell $ gecos $ description ) ) SAGE-AU Conf 2003 – p. 71
LDAP Protocol Uses client server model Message oriented protocol - client sends messages to server and gets replies Can issue multiple requests at once - each response has message id to identify 9 basic protocol operations - interrogation, update and authentication LDAPv3 provides extended operations and controls Uses simplified version of Basic Encoding Rules (BER) - not plain text SAGE-AU Conf 2003 – p. 72
LDAP Protocol Operations Interrogation operations search compare Update operations add delete modify rename Authentication and control operations bind unbind abandon SAGE-AU Conf 2003 – p. 73
Typical LDAP conversation Client Server Open connection and bind Result of bind operation Search operation Returned entry 1 Returned entry 2 Results of search operation Unbind operation Close connection SAGE-AU Conf 2003 – p. 74
Bind Operations How client authenticates to directory Opens TCP connection, gives distinguished name and credentials Server checks credentials are correct, returns result to client If credentials fail, returns an anonymous bind Authentication lasts while connection is open, or until client reauthenticates Credentials can be password, digital certificate or other SAGE-AU Conf 2003 – p. 75
Authentication Levels There are 3 basic levels of authentication: Anonymous - no username and password Enabled by default, disable using “disallow bind_anon” in slapd.conf Unauthenticated - only username (sometimes called reference bind) Disabled by default, enable using “allow bind_anon_cred” in slapd.conf Authenticated - username and correct password Enabled by default, disable using “disallow bind_anon_simple” in slapd.conf SAGE-AU Conf 2003 – p. 76
LDAP Security Model Authentication How to verify identities Password policies Criteria passwords must satisfy to be valid - ie, length, age etc Encryption Ensuring data is private Access control Who can access what data Auditing Determine if security model is being followed - ie, logs SAGE-AU Conf 2003 – p. 77
Security Model - Authentication Anonymous access Simple password Proxy authentication Simple password over encrypted connection Certificate based authentication SASL based authentication SAGE-AU Conf 2003 – p. 78
Password policies Minimum length Maximum age Syntax checking History keeping Expiration policy Account lockout policy SAGE-AU Conf 2003 – p. 79
Access Control Set permissions on: Entire directory Subtree Specific entries Specific attributes Any entry that matches a search filter SAGE-AU Conf 2003 – p. 80
LDAP URLs Definition taken from RFC2255 <ldapurl> ::= "ldap://" [ <hostport> ] "/" <dn> [ "?" <attributes> [ "?" <scope> "?" <filter> ] ] <hostport> ::= <hostname> [ ":" <portnumber> ] <dn> ::= a string as defined in RFC 1485 <attributes> ::= NULL | <attributelist> <attributelist> ::= <attributetype> | <attributetype> [ "," <attributelist> ] <attributetype> ::= a string as defined in RFC 1777 <scope> ::= "base" | "one" | "sub" <filter> ::= a string as defined in RFC 1558 SAGE-AU Conf 2003 – p. 81
LDAP URLs DN Distinguished name Attribute list List of attributes you want returned Scope base base object search one one level search sub subtree search Filter Standard LDAP search filter SAGE-AU Conf 2003 – p. 82
LDAP URL examples ldap://foo.bar.com/dc=bar,dc=com ldap://argle.bargle.com/dc=bar, dc=com??sub?uid=barney ldap://ldap.bedrock.com/dc=bar, dc=com?cn?sub?uid=barney SAGE-AU Conf 2003 – p. 83
LDAP Related Standards Bodies Consortiums and Standard Bodies OASIS Directory Services Markup Language Distributed Management Task Force (DMTF) Common Informational Model (CIM) Network Applications Consortium (NAC) Users Group Open Group Directory Interoperability Forum (DIF) LDAP2000 Interoperability Internet Engineering Task Force (IETF) LDAP Standards SAGE-AU Conf 2003 – p. 84
IETF Working Groups IETF Working Groups LDAPExt Access Controls APIs LDUP Replication LDAPbis LDAPv3 Protocol revisions SAGE-AU Conf 2003 – p. 85
LDAPv3 Internationalization - using UTF-8 Referrals and Continuations Security Authentication via SASL Integrity and Confidentiality Protection via TLS or SSL Extensibility Feature and schema discovery LDAPv3 servers have a directory entry called root DSE (Directory Server Entry) Contains: protocol supported, schemas, other useful info SAGE-AU Conf 2003 – p. 86
Directory Uses 3 main uses of directories Network directory Provides user account management Enterprise directory Global repository for shared information Details about people, organisations and devices Business directory Details about trading partners, customers, suppliers etc SAGE-AU Conf 2003 – p. 87
Directory Life Cycle 3 main parts to life cycle: Design Understand directory requirements and gather data Deployment Actually try out directory Maintenance Update data, keep service running, and improve SAGE-AU Conf 2003 – p. 88
Design Cycle Directory needs Understand what applications require Data Find existing data sources Determine relationship to directory Schema Develop schemas for applications requirements Namespace Organise data layout SAGE-AU Conf 2003 – p. 89
Design Cycle cont Topology Determine where servers are located Determine how data is divided Replication Ensure data is available where it is needed Security Essential to meeting security and privacy requirements of users SAGE-AU Conf 2003 – p. 90
Deployment Cycle Choose directory software Evaluate and choose software Piloting Inital testing to check design Performance and scaling testing Testing to see if system can handle the task Tuning Check process as well as technical User feedback Expose users to test system Going into production Move from pilot to production SAGE-AU Conf 2003 – p. 91
Maintenance Cycle Data maintenance Keeping data up to date Data backups Ensure backups don’t interfer with operations Replication can help here Schema additions Extend schemas when adding new applications Monitoring Integrate with existing system if possible Expansion Try to plan for expansion - growth may surprise you Changing requirements Don’t get caught out SAGE-AU Conf 2003 – p. 92
Directory Management Directory management consists of: Namespace and directory tree design Determine root naming context Integration with existing data Synchronization Maintaining data Choosing mangement model SAGE-AU Conf 2003 – p. 93
Basic Design Steps Define applications for directory Find data sources and relationships Schema design Namespace design and topology Replication Extraction and population Testing and deployment SAGE-AU Conf 2003 – p. 94
Schema Design Be aware of existing schemas and use them if possible Use schemas provided with applications Define and document any new schemas required Be prepared for schema evolution as things change SAGE-AU Conf 2003 – p. 95
Namespace Design Designing a namespace is Hard Requires indepth knowledge of what the directory will be used for Hard to reorganise once data is put in - requires downtime, etc Needs to support applications that want to use it - be aware of existing standards SAGE-AU Conf 2003 – p. 96
Namespace Design cont Try not to break out into different departments - what happens when person moves? Avoid designs that will have to change - eg, don’t base on org chart Don’t go overboard - too much hierachy can get confusing Probably won’t get it right first - will take some iterations SAGE-AU Conf 2003 – p. 97
Namespace Design cont Good namespace design helps with: Delegation of authority Replication of data Security and access control Scalability Physical placement of servers SAGE-AU Conf 2003 – p. 98
Tree Design 3 most commonly used tree designs for a single company Organizational Flat Geographical SAGE-AU Conf 2003 – p. 99
Organizational Based Tree dc=pisoftware dc=com ou=Sales ou=Devel ou=Sysadmin ou=People ou=Groups ou=Apps SAGE-AU Conf 2003 – p. 100
Organizational Based Details Mirrors organizational structure Good for using delegated administration management model People changing jobs mean a change to distinguished name Groups refer to distinguished names - no referential integrity checking SAGE-AU Conf 2003 – p. 101
Flat Tree dc=pisoftware dc=com ou=People ou=Groups ou=Apps SAGE-AU Conf 2003 – p. 102
Flat Details Simplest layout - all people and groups are in one level down from root Entries only added or removed on hiring and firing - not internal job changes Most directory servers can’t split single branch across multiple servers Harder to delegate admin control SAGE-AU Conf 2003 – p. 103
Geographical Tree dc=pisoftware dc=com ou=Australia ou=Asia ou=America ou=People ou=Groups ou=Apps SAGE-AU Conf 2003 – p. 104
Geographical Details Branch for each geographical location of the company Each geographical location has a master, also replicates rest of tree Rarer for people to move between geographical locations Geographical dispersement of company might not match political SAGE-AU Conf 2003 – p. 105
Choosing Root Naming Context Root naming context is servers top level entry Some servers can have multiple root naming contexts Two main choices: Traditional Domain component Active Directory doesn’t give a choice for root naming context, most others do SAGE-AU Conf 2003 – p. 106
Traditional Style Traditionally has been ‘o=company,c=country’ Company is free-form string of company name Country is ISO 2 letter country code Inherited from X.500 Can cause conflicts between similarly named companies SAGE-AU Conf 2003 – p. 107
Domain Component Style Use DNS name to generate base DN See RFC2377 for more details - "Naming Plan for Internet Directory-Enabled Applications" example.com gives dc=example,dc=com Already globally unique Already registered Can trace back to who owns it easily Some CAs only allow traditional X.500 attributes, which doesn’t include dc SAGE-AU Conf 2003 – p. 108
Topology Design Directory tree can be spread over multiple physical servers Design is important to: Increase performance Increase availability Better manage directory Hold more entries than a single server could Users see one large directory Closely related to replication design SAGE-AU Conf 2003 – p. 109
Topology Design Each server is delegated a partition of the directory Similar to DNS One server is the root and is common ancestor to all subpartitions Partitions must be a complete subtree, and not exclude any entries Servers can hold more than one partition, eg read-only copies SAGE-AU Conf 2003 – p. 110
Topology Design - References Directory glued together using knowledge references Immediate superior knowledge references Points up the tree Hooks back up to ancestor Subordinate knowledge references Points down the tree to other partitions Hook to hang other partitions off SAGE-AU Conf 2003 – p. 111
Topology Design - Why Partition Too many entries for a single server Increase performance and scalability Applications mostly read and modify entries in local section of tree Replication traffic to a single partition is too large If partitioning allows traffic to remain local, won’t have to cross slow WAN links If directory use will rapidly expand SAGE-AU Conf 2003 – p. 112
Topology Design - Why Not Partition All entries can fit on a single server Applications modify entries across whole tree Not much replication traffic Organisation is centrally located, no slow WAN links Directory use is static and won’t exceed capabilities of single server SAGE-AU Conf 2003 – p. 113
Topology Design - Considerations Consider directory enabled applications and performance requirements Understand server software limitations and capabilities Consider physical layout of network and location of applications Ensure namespace design fits within constraints - ie, flat namespace isn’t good for partitioning SAGE-AU Conf 2003 – p. 114
Replication Design Increases reliability and performance Allows locating data close to users and applications that need them Can manage data where it is being used Gives redundancy - applications can fail over to replicas Can distribute load across multiple servers, increasing performance Closely related to topology design SAGE-AU Conf 2003 – p. 115
Replication Design Strategy High availability Multiple directories at one site Use multi-master to ensure write-failover Local availability Replicas at local offices Useful if network links are unreliable or intermittant Helps reduce load on master server Masters can be at: Central office Local server is master for local part of directory tree SAGE-AU Conf 2003 – p. 116
Replication Design Strategy cont Disaster recovery Two masters at geograhically disperse locations Provides failover and data protection Load balancing Spread user connections over servers Dedicate servers to read-only activities Dedicate servers to particular activities - ie, server for mail SAGE-AU Conf 2003 – p. 117
Replication Issues to Consider Quality of links between remote sites Amount of bandwidth between sites Is replication traffic too much for link Physical location of users How many users What type of work they do Number of applications Type and proportion of operations done Size of directory SAGE-AU Conf 2003 – p. 118
Management Models 3 main management models Centralized administration Distributed administration User self-administration SAGE-AU Conf 2003 – p. 119
Centralized Administration Good for smaller organisations All changes are made in the one location or group of people Minimal admin infrastruture Low potential for duplication of data Can cause bottlenecks in changes being made - long delays Often seen as most secure - not always the case Possibly too much trust in central group Within sub-departments, possibility that changes may not happen quickly enough - eg, employee is fired and notification takes time to make it to central accounts department SAGE-AU Conf 2003 – p. 120
Distributed Administration Centralised department co-ordinates sub-groups, who do actual admin work Reduces admin bottlenecks Very scalable Similar to how DNS admin is done - root nameservers handle top level, then delegated out Namespace design is important - hard to distribute across flat namespace SAGE-AU Conf 2003 – p. 121
User Self-Administrated User creates and manages own account - eg Internet shopping Web forms often used to let end users admin own accounts Common to seperate end user admined accounts from other part of directory Lower level of trust of data done this way Usually use other form of data / contact - eg frequent flyers database, using email address SAGE-AU Conf 2003 – p. 122
Data Maintenance Maintenance is most important part Usually involved with maintance the longest, often least though about aspect Configuration is comparitively simple, managing contents is hard The best designed directory is useless with out of date or incomplete data SAGE-AU Conf 2003 – p. 123
Managing Directory Contents People can have multiple accounts, or a single account (or group) can have multiple people associated Need to manage association between accounts and people, as well as managing the people This is essential to be able to terminate all accounts associated with a terminated employee Important as ldap doesn’t ensure referential integrity - can be left with dangling references SAGE-AU Conf 2003 – p. 124
Managing Data Flow Managing data integration between directories has a number of approaches: Replication Data export/import Scripting Metadirectories Virtual Directories SAGE-AU Conf 2003 – p. 125
Replication Exactly duplicating data between directories This creates a copy of data for distribution, performance, scalability and redundancy No LDAP standard for replication, so hard to replicate between different vendors IETF is developing LDUP, an independant replication protocol SAGE-AU Conf 2003 – p. 126
Data export/import Export data out from one directory, then import into next Can manipulate data after exporting Servers must support either of 2 main standards LDIF DSML Updates only happen periodically, data is out of sync between these times SAGE-AU Conf 2003 – p. 127
Scripting Writing scripts to manipulate data between servers Allows choosing subset of data to transfer Easy to change / manipulate data Common languages are Perl, Java and C SAGE-AU Conf 2003 – p. 128
Metadirectories Consolidates subsets of data from various locations Presents it as LDAP, XML, HTTP etc Consolidates and aggregates details about objects Can provide multiple views of data Helps manage relationships between directories Manages data flow between directories Can reflect information back to original or new data sources Not just a consolidated directory of all information SAGE-AU Conf 2003 – p. 129
Metadirectories cont Consists of: Metadirectory namespace Join engine Connectors Comes in two different forms Add on to existing directory Stand alone directory SAGE-AU Conf 2003 – p. 130
Metadirectories Namespace Also called meta view Unified view of underlying directories / data sources Usually stored in a LDAP directory Uses join engine to synchronize underlying sources SAGE-AU Conf 2003 – p. 131
Metadirectories Join Engine Managed data flow between external sources and metadirectory views Defines authoritive source for each bit of data Controls which data sources can be changed via meta directory Manipulates and unifies connector views to provide meta view Links items in connector views with items in meta view Can construct attributes from other values SAGE-AU Conf 2003 – p. 132
Metadirectories Connectors Provides data from external sources to join engine Connects between directory and data sources Can provide name mapping to translate from original data source to LDAP Defines which attributes to use or discard Provides a connector view Two types: Direct connector: talks directly to source, usually either LDAP or SQL Indirect connector: converts from source data into LDAP SAGE-AU Conf 2003 – p. 133
Virtual Directories LDAP frontend to databases / directories Provides schema adaptors Failover and load balancing Namespace conversions Value manipulations Add/modify/delete attributes Remove or construct attributes based on criteria SAGE-AU Conf 2003 – p. 134
Data Flow Analysis Schema mapping Mapping schemas between directories Determining authoritative source Find which directory has most up to date for each part of data Data tranformation Not all systems store data in the same format, eg may use extra lookup tables Change data representation to be the same format in each directory Namespace translation Sometimes can’t translate directly - can get conflicts Sometimes can just change root naming context SAGE-AU Conf 2003 – p. 135
Data Sources Existing directory services Operating systems Existing databases Flat files or spreadsheets Applications Sysadmins End users SAGE-AU Conf 2003 – p. 136
Common Data Problems Things to be careful of: Too much information - can’t find what is needed Not enough information Poor quality information Out of date information SAGE-AU Conf 2003 – p. 137
Tips for Success Carefully pick and stick to scope of project Start small, show incremental successes Pick low hanging fruit, and stay visible Deploy in parallel with existing systems Design for end result - doesn’t have to get there straight away Identify who’s responsible early Use info with greatest value first Allow time for political and process issues Be careful what you promise and manage expectations SAGE-AU Conf 2003 – p. 138
Important RFCs RFC Title RFC2247 Using Domains in LDAP DNs RFC2251 LDAPv3 Protocol RFC2252 LDAPv3 Attribute Types RFC2253 LDAPv3 Disinguished Name RFC2254 LDAPv3 Search Filters RFC2255 LDAPv3 URL Format RFC2256 A Summary of the X.500(96) User Schema RFC2307 LDAP Network Information Services Schema RFC2377 LDAP Naming Plan SAGE-AU Conf 2003 – p. 139
Important RFCs cont RFC Title RFC2798 LDAP inetOrgPerson schema RFC2829 LDAPv3: Authentication Methods RFC2830 LDAPv3: Start TLS RFC2849 LDIFv1 RFC2891 LDAPv3: Server Side Sorting of Search Results RFC3112 LDAP Authentication Password Schema RFC3377 LDAP(v3): Technical Specification SAGE-AU Conf 2003 – p. 140
References Understanding and Deploying LDAP Directory Services Timothy A. Howes, Mark C. Smith and Gordon S. Good Macmillan Network Architecture and Development Series Implementing LDAP Mark Wilcox Wrox Press Ltd LDAP Programming, Management and Integration Clayton Donley Manning Publications SAGE-AU Conf 2003 – p. 141
References cont Summary Report from Catalyst 99 Directory Namespace and Best Practices Workshop, The Burton Group and The Network Applications Consortium OpenLDAP 2.1 Administrators Guide, http://www.openldap.org/doc/admin21/ LDAP Linux HOWTO, Luiz Ernesto Pinheiro Malere, Linux Documentation Project LDAP Implementation HOWTO, Roel van Meer, Linux Documentation Project SunONE Directory Server 5.2 Deployment Guide SunONE Meta Directory Server 5.1 Deployment Guide The Slapd and Slurpd Administrator’s Guide, University of Michigan, Release 3.3 SAGE-AU Conf 2003 – p. 142

More Related Content

PPT
Active Directory Training
byNishad Sukumaran
 
PPTX
LDAP - Lightweight Directory Access Protocol
byS. Hasnain Raza
 
PPT
Active directory
bydeshvikas
 
PPT
Active directory and application
byaminpathan11
 
PPT
Active directory slides
byTimothy Moffatt
 
PPTX
Windows server
byHideo Amezawa
 
PDF
Introduction to LDAP and Directory Services
byRadovan Semancik
 
PDF
SDN Presentation
byAbderrahmane TEKFI
 
Active Directory Training
byNishad Sukumaran
 
LDAP - Lightweight Directory Access Protocol
byS. Hasnain Raza
 
Active directory
bydeshvikas
 
Active directory and application
byaminpathan11
 
Active directory slides
byTimothy Moffatt
 
Windows server
byHideo Amezawa
 
Introduction to LDAP and Directory Services
byRadovan Semancik
 
SDN Presentation
byAbderrahmane TEKFI
 

What's hot

PPT
Active Directory
bySandeep Kapadane
 
PPT
Active Directory Services
byVarun Arora
 
PPT
LDAP
byKhemnath Chauhan
 
PPT
AD & LDAP
byCynoteck Technology Solutions Private Limited
 
PPTX
Ldap intro
byyousry ibrahim
 
PPT
active-directory-domain-services
by202066
 
PPTX
Firewall in Network Security
bylalithambiga kamaraj
 
PPTX
Cisco Identity Services Engine (ISE)
byAnwesh Dixit
 
PPT
Microsoft Active Directory
bythebigredhemi
 
PPTX
Types Of Firewall Security
byiberrywifisecurity
 
PDF
Engineering The New IP Transport
byMyNOG
 
PPTX
Apache Hadoop Security - Ranger
byIsheeta Sanghi
 
PDF
Palo alto networks product overview
byBelsoft
 
PPTX
DNS Configuration
byVinod Gour
 
PDF
Introduction to SDN and Network Programmability - BRKRST-1014 | 2017/Las Vegas
byBruno Teixeira
 
PPT
RADIUS
byamogh_ubale
 
PDF
Linux: LVM
byMichal Sedlak
 
PPTX
Introduction to Graph Databases
byMax De Marzi
 
PPTX
VMworld 2016: How to Deploy VMware NSX with Cisco Infrastructure
byVMworld
 
PDF
NFS(Network File System)
byudamale
 
Active Directory
bySandeep Kapadane
 
Active Directory Services
byVarun Arora
 
LDAP
byKhemnath Chauhan
 
AD & LDAP
byCynoteck Technology Solutions Private Limited
 
Ldap intro
byyousry ibrahim
 
active-directory-domain-services
by202066
 
Firewall in Network Security
bylalithambiga kamaraj
 
Cisco Identity Services Engine (ISE)
byAnwesh Dixit
 
Microsoft Active Directory
bythebigredhemi
 
Types Of Firewall Security
byiberrywifisecurity
 
Engineering The New IP Transport
byMyNOG
 
Apache Hadoop Security - Ranger
byIsheeta Sanghi
 
Palo alto networks product overview
byBelsoft
 
DNS Configuration
byVinod Gour
 
Introduction to SDN and Network Programmability - BRKRST-1014 | 2017/Las Vegas
byBruno Teixeira
 
RADIUS
byamogh_ubale
 
Linux: LVM
byMichal Sedlak
 
Introduction to Graph Databases
byMax De Marzi
 
VMworld 2016: How to Deploy VMware NSX with Cisco Infrastructure
byVMworld
 
NFS(Network File System)
byudamale
 

Viewers also liked

PPT
The Ldap Protocol
byGlen Plantz
 
PPTX
LDAP
byChandanapriya Sathavalli
 
PPT
LDAP Presentation
bycyberleon95
 
PDF
Integración LDAP + SAMBA
bycyberleon95
 
PDF
Configuración VPN Sitio a Sitio en ENDIAN
bycyberleon95
 
PDF
Configuración VPN de Acceso remoto con TMG
bycyberleon95
 
PDF
Distributed computing time
byDeepak John
 
PDF
Manual Instalación y Configuración Firewall TMG
bycyberleon95
 
PDF
Introduccion LDAP
bycyberleon95
 
PDF
Servicio de Directorio
bycyberleon95
 
DOC
Ldap
byShiva Krishna Chandra Shekar
 
PDF
Instalación y Configuración Firewall ENDIAN
bycyberleon95
 
PDF
OPENLDAP Red Hat Enterprise Linux 6.2
bycyberleon95
 
PPTX
Global state recording in Distributed Systems
byArsnet
 
PDF
Lessons Learned from Federal ICAM - User Group
byJoel Rader, CISSP
 
PPTX
Flexible Symmetric Global Snapshot
byAshutosh Jaiswal
 
PPT
Distributed Snapshots
byawesomesos
 
PDF
CIS13: A Breakthrough in Directory Technology: Meet the Elephant in the Room ...
byCloudIDSummit
 
PPT
network filesystem briefs
bybergwolf
 
PDF
Guia Funcionamiento LDAP
bycyberleon95
 
The Ldap Protocol
byGlen Plantz
 
LDAP
byChandanapriya Sathavalli
 
LDAP Presentation
bycyberleon95
 
Integración LDAP + SAMBA
bycyberleon95
 
Configuración VPN Sitio a Sitio en ENDIAN
bycyberleon95
 
Configuración VPN de Acceso remoto con TMG
bycyberleon95
 
Distributed computing time
byDeepak John
 
Manual Instalación y Configuración Firewall TMG
bycyberleon95
 
Introduccion LDAP
bycyberleon95
 
Servicio de Directorio
bycyberleon95
 
Ldap
byShiva Krishna Chandra Shekar
 
Instalación y Configuración Firewall ENDIAN
bycyberleon95
 
OPENLDAP Red Hat Enterprise Linux 6.2
bycyberleon95
 
Global state recording in Distributed Systems
byArsnet
 
Lessons Learned from Federal ICAM - User Group
byJoel Rader, CISSP
 
Flexible Symmetric Global Snapshot
byAshutosh Jaiswal
 
Distributed Snapshots
byawesomesos
 
CIS13: A Breakthrough in Directory Technology: Meet the Elephant in the Room ...
byCloudIDSummit
 
network filesystem briefs
bybergwolf
 
Guia Funcionamiento LDAP
bycyberleon95
 

Similar to LDAP Theory

PDF
Directory services
byChristalin Nelson
 
PPTX
Ldap
byHigher Private School of Engineering and Technology
 
PPTX
network administration directory access and remote access
bySangeetha Rangarajan
 
PDF
Ldap introduction (eng)
byAnatoliy Okhotnikov
 
PPTX
Directory Introduction
byAidy Tificate
 
DOCX
X.500 More Than a Global Directory
bylurdhu agnes
 
PPT
Ldap system administration
byAli Abdo
 
PDF
topic_2 computer system design&admin)part 2 A.pdf
byfrancisnwaeze431
 
PDF
LDAP Applied (EuroOSCON 2005)
byFran Fabrizio
 
PPT
An X.500 certificate in the context of CNS (Carta Nazionale dei Servizi) refe...
bynasreenkausar097
 
PDF
introduction to ldap
byThevakumar Presanth
 
PDF
Practical-LDAP-and-Linux
byBalaji Ravi
 
DOCX
LDAP
byChandanapriya Sathavalli
 
PDF
Active directory
bygunakhan
 
DOC
LDAP
byLokesh Kumar N
 
ODP
Ldapsession 1217528612650451-9
byrezgui
 
ODP
Ldapsession
byguest648519
 
PPT
Directory services by SAJID
bySajid khan
 
PDF
Ldap 121020013604-phpapp01
bySANE Ibrahima
 
PDF
Directory Servers and LDAP
byWildan Maulana
 
Directory services
byChristalin Nelson
 
Ldap
byHigher Private School of Engineering and Technology
 
network administration directory access and remote access
bySangeetha Rangarajan
 
Ldap introduction (eng)
byAnatoliy Okhotnikov
 
Directory Introduction
byAidy Tificate
 
X.500 More Than a Global Directory
bylurdhu agnes
 
Ldap system administration
byAli Abdo
 
topic_2 computer system design&admin)part 2 A.pdf
byfrancisnwaeze431
 
LDAP Applied (EuroOSCON 2005)
byFran Fabrizio
 
An X.500 certificate in the context of CNS (Carta Nazionale dei Servizi) refe...
bynasreenkausar097
 
introduction to ldap
byThevakumar Presanth
 
Practical-LDAP-and-Linux
byBalaji Ravi
 
LDAP
byChandanapriya Sathavalli
 
Active directory
bygunakhan
 
LDAP
byLokesh Kumar N
 
Ldapsession 1217528612650451-9
byrezgui
 
Ldapsession
byguest648519
 
Directory services by SAJID
bySajid khan
 
Ldap 121020013604-phpapp01
bySANE Ibrahima
 
Directory Servers and LDAP
byWildan Maulana
 

More from cyberleon95

PDF
Teoría Plataformas de Monitoreo
bycyberleon95
 
PDF
Trabajo IOS de CISCO
bycyberleon95
 
PDF
Centos 6.5 Servidor Básico
bycyberleon95
 
PDF
Manual WSUS - Windows Server 2008 R2
bycyberleon95
 
PDF
Integración GNS3 - VirtualBox - Wireshark
bycyberleon95
 
PDF
Conceptos VoIP
bycyberleon95
 
PDF
Sendero del Hacker
bycyberleon95
 
PDF
Autodiagnostico 5 Trimestre
bycyberleon95
 
PDF
Configuración DHCP - NAT
bycyberleon95
 
PDF
Manual PXE - RHEL 6.2
bycyberleon95
 
PDF
Herramientas Administrativas de Red
bycyberleon95
 
PDF
Actividad Topologías VoIP
bycyberleon95
 
PDF
Gestión del Talento Humano
bycyberleon95
 
PDF
Correo Red Hat Enterprise Linux 6.2
bycyberleon95
 
PDF
Manual WDS - Windows Server 2008 R2
bycyberleon95
 
PDF
Documentación ACL - Firewall ASA
bycyberleon95
 
PDF
Instalación y Configuración SSH CentOS 6.5 / RHEL 6.2
bycyberleon95
 
PDF
Análisis de riesgos y vulnerabilidades
bycyberleon95
 
PDF
Manual Monitoreo de Servidores
bycyberleon95
 
PDF
Plan de continuidad
bycyberleon95
 
Teoría Plataformas de Monitoreo
bycyberleon95
 
Trabajo IOS de CISCO
bycyberleon95
 
Centos 6.5 Servidor Básico
bycyberleon95
 
Manual WSUS - Windows Server 2008 R2
bycyberleon95
 
Integración GNS3 - VirtualBox - Wireshark
bycyberleon95
 
Conceptos VoIP
bycyberleon95
 
Sendero del Hacker
bycyberleon95
 
Autodiagnostico 5 Trimestre
bycyberleon95
 
Configuración DHCP - NAT
bycyberleon95
 
Manual PXE - RHEL 6.2
bycyberleon95
 
Herramientas Administrativas de Red
bycyberleon95
 
Actividad Topologías VoIP
bycyberleon95
 
Gestión del Talento Humano
bycyberleon95
 
Correo Red Hat Enterprise Linux 6.2
bycyberleon95
 
Manual WDS - Windows Server 2008 R2
bycyberleon95
 
Documentación ACL - Firewall ASA
bycyberleon95
 
Instalación y Configuración SSH CentOS 6.5 / RHEL 6.2
bycyberleon95
 
Análisis de riesgos y vulnerabilidades
bycyberleon95
 
Manual Monitoreo de Servidores
bycyberleon95
 
Plan de continuidad
bycyberleon95
 

Recently uploaded

PDF
Unit4DC_TransportLayer &NetworkLayer.pdf
bySonaShaiju1
 
PDF
Hunwick's Roman Roads and Ridge Roads, a Discussion Document
byJohn Pallister
 
PDF
Navigating the Age of AI- Combating Social Isolation and Building Global Peac...
byALLLIFEREGARDSMFT
 
PDF
Genetic Erosion in Crop Plants: Causes, Consequences, and Conservation Strate...
bySatyam Sharma
 
PDF
GIÁO ÁN KẾ HOẠCH BÀI DẠY TIẾNG ANH GLOBAL SUCCESS LỚP 12 (CẢ NĂM) THEO CÔNG V...
byNguyen Thanh Tu Collection
 
PPTX
ANKYLOSING SPONDYLITIS OR BAMBOO SPINE.pptx
byDrNidhiAgarwal
 
PDF
Plant Domestication | Evolution of Modern Agriculture
bySatyam Sharma
 
PDF
Gene Pool in Crop Plants: Diversity, Classification, and Role in Plant Breedi...
bySatyam Sharma
 
PPTX
Unit 3-proteins.pptx....................
byAkanksha Kotangale
 
PDF
FA Term 2 Reiki Yoga All Student Workshop 22
byLDMMIA, Reiki Yoga
 
PDF
Major Evolutionary Patterns in Crop Plants: Implications for Breeding and Div...
bySatyam Sharma
 
PDF
AI Literacy Essentials for Adults with Jeff Neill and Cyndy McDonald
byCyndy McDonald
 
PDF
Creating Motion Graphics and Videos with Generative AI
byShalin Hai-Jew
 
PPTX
business economics unit 3 production dr kanchan (1).pptx
byDr. Kanchan Kumari
 
PPTX
Gastroretentive Drug Delivery Systems (GRDDS) – Concepts, Mechanisms, and App...
byseemashinde5197
 
PDF
Political conditions of India during 6th cent BCE: Janpadas and Republics
byPrachiSontakke5
 
PPTX
Targeted Drug Delivery System – Liposomes, Nanoparticles, Niosomes & Monoclon...
byseemashinde5197
 
PPTX
28 October 2025 - Andreas Schleicher presents at the OECD Webinar Insights on...
byEduSkills OECD
 
PPTX
jkjkjkjkjkjkjkjfjeofu9 u93r u80 dhuybufy eiufcuetc i heiehf
bypreetheshparmar
 
PPTX
Developmental stage of Binocular vision.pptx
byBarsitaPanchariya
 
Unit4DC_TransportLayer &NetworkLayer.pdf
bySonaShaiju1
 
Hunwick's Roman Roads and Ridge Roads, a Discussion Document
byJohn Pallister
 
Navigating the Age of AI- Combating Social Isolation and Building Global Peac...
byALLLIFEREGARDSMFT
 
Genetic Erosion in Crop Plants: Causes, Consequences, and Conservation Strate...
bySatyam Sharma
 
GIÁO ÁN KẾ HOẠCH BÀI DẠY TIẾNG ANH GLOBAL SUCCESS LỚP 12 (CẢ NĂM) THEO CÔNG V...
byNguyen Thanh Tu Collection
 
ANKYLOSING SPONDYLITIS OR BAMBOO SPINE.pptx
byDrNidhiAgarwal
 
Plant Domestication | Evolution of Modern Agriculture
bySatyam Sharma
 
Gene Pool in Crop Plants: Diversity, Classification, and Role in Plant Breedi...
bySatyam Sharma
 
Unit 3-proteins.pptx....................
byAkanksha Kotangale
 
FA Term 2 Reiki Yoga All Student Workshop 22
byLDMMIA, Reiki Yoga
 
Major Evolutionary Patterns in Crop Plants: Implications for Breeding and Div...
bySatyam Sharma
 
AI Literacy Essentials for Adults with Jeff Neill and Cyndy McDonald
byCyndy McDonald
 
Creating Motion Graphics and Videos with Generative AI
byShalin Hai-Jew
 
business economics unit 3 production dr kanchan (1).pptx
byDr. Kanchan Kumari
 
Gastroretentive Drug Delivery Systems (GRDDS) – Concepts, Mechanisms, and App...
byseemashinde5197
 
Political conditions of India during 6th cent BCE: Janpadas and Republics
byPrachiSontakke5
 
Targeted Drug Delivery System – Liposomes, Nanoparticles, Niosomes & Monoclon...
byseemashinde5197
 
28 October 2025 - Andreas Schleicher presents at the OECD Webinar Insights on...
byEduSkills OECD
 
jkjkjkjkjkjkjkjfjeofu9 u93r u80 dhuybufy eiufcuetc i heiehf
bypreetheshparmar
 
Developmental stage of Binocular vision.pptx
byBarsitaPanchariya
 

LDAP Theory

  • 1.
    LDAP Theory andManagement Brad Marshall [email protected] SAGE-AU Conf 2003 – p. 1
  • 2.
    Contents What is LDAP? Directoryservices LDAP Models Namespaces Schema Replication LDIF and DSML Search Filters LDAP Protocol SAGE-AU Conf 2003 – p. 2
  • 3.
    Contents cont Directory LifeCycle Directory Management Namespace Design Topology Design Replication Design Management Models Data Maintanence Metadirectories Virtual directories SAGE-AU Conf 2003 – p. 3
  • 4.
    History of LDAP Originallystarted as a front end to X.500 Provides much of X.500’s functionality at a lower implementation cost Removed redundant and rarely used operations Uses TCP rather than OSI stack University of Michigan wrote first LDAP implementation Most early LDAP implementations were based on it U.Mich eventually realized didn’t need X.500 and wrote lightweight server Meant it was easier to deploy, and more people started using it SAGE-AU Conf 2003 – p. 4
  • 5.
    What is LDAP? LDAP= Lightweight Directory Access Protocol Stanard protocol that can be used to access information over a network Based on X.500 Directory Service Described in RFC1777 and RFC2251 Stores attribute based data SAGE-AU Conf 2003 – p. 5
  • 6.
    What is LDAPcont Data generally read more than written to No transactions No rollback Client-server model Based on entries Collection of attributes Globally unique distinguished name (DN) - like domain name Entries arranged in hierarchical tree structure SAGE-AU Conf 2003 – p. 6
  • 7.
    Directory Services Directories area specialized database Used in everyday lives - phone book, TV guides, etc Everyday directories fairly static Online directories are dynamic, flexible, secure and can be personalized Examples of online directories are finger, DNS, NIS and unix password file SAGE-AU Conf 2003 – p. 7
  • 8.
    Why use LDAP Centrallymanage users, groups and other data Don’t have to manage separate directories for each application - stops the “N + 1 directory problem” Distribute management of data to appropriate people Allow users to find data that they need Not locked into a particular server Ability to distribute servers to where they are needed Standards available for sharing data SAGE-AU Conf 2003 – p. 8
  • 9.
    What LDAP cando Find things - local office phone book, Internet directories such as Four11, BigFoot etc Manage things - users and groups. Removes “N + 1” directory problem Lightweight database applications - sort bookmarks, small bits of data Security - store username and passwords, digital certificates, PKI etc SAGE-AU Conf 2003 – p. 9
  • 10.
    What LDAP can’tdo LDAP isn’t a relational database No rollback for failed operations LDAP isn’t a filesystem No locking or seeking Can’t search blobs of data LDAP isn’t good for dynamic objects Optimized for read, not write No locking to ensure transactions occur in a certain order - corruption could occur No generic SQL-like reporting language Not useful without applications SAGE-AU Conf 2003 – p. 10
  • 11.
    LDAP vs Databases Read-writeratio - LDAP is read optimized Extensibility - LDAP schemas are more easily changed Distribution - with LDAP data can be near where it is needed, and highly distributed Replication - with LDAP data can be stored in multiple locations Different performance - directories used for many different applications, and queries are usually simpler, but many more of them Data sharing - LDAP is designed for sharing data, databases designed for one application SAGE-AU Conf 2003 – p. 11
  • 12.
    LDAP vs Databasescont Database objects have complex relationships Transaction model - LDAP transactions are simple - usually changing one entry, databases can modify much more Size of information - LDAP is better at storing small bits of information Type of information - LDAP stores information in attributes Naming model - LDAP is hierachical Schemas - database schemas are entirely user defined, directories have core schemas to help interoperability Standards are more important for directories - LDAP clients can talk to any LDAP server, but database client can only talk to the database it was designed for SAGE-AU Conf 2003 – p. 12
  • 13.
    LDAP vs NIS Usesarbitrary ports No data encryption No access-control mechanism Uses a flat (non scalable) namespace Uses a single-key database (providing only basic searching abilities) All changes had to be made by the superuser on the domain master Does not provide directory services for non name service applications No ability for clustering (slapd replication and round robin DNS for LDAP) SAGE-AU Conf 2003 – p. 13
  • 14.
    X.500 Designed by InternationalTelecom Union (ITU) and International Organization for Standards (ISO) First designed in 1988 First general purpose directory system Designed to be extensible - rich search operations Open standard Relies on large suite of protocols Early implementations buggy and slow Based on OSI network protocols, not TCP/IP SAGE-AU Conf 2003 – p. 14
  • 15.
    LDAP Directory Services Twogeneral types of directory servers: Stand alone LDAP servers LDAP is only access mechanism Data stores tuned for LDAP LDAP gateway servers Translate betwen LDAP and some other protocol Original use of LDAP - gateway to X.500 Doesn’t really matter where data is stored, as long as it is accessible via LDAP SAGE-AU Conf 2003 – p. 15
  • 16.
    Common LDAP Applications Whitepages Authentication and authorization Personalization Roaming profiles Public Key Infrastructure (PKI) Message delivery SAGE-AU Conf 2003 – p. 16
  • 17.
    LDAP Models Information Model- defines the types of data and basic units of info stored in directory Naming Model - defines how to organise and refer to the data Functional Model - defines operations in LDAP protocol Security Model - defines framework for protecting information SAGE-AU Conf 2003 – p. 17
  • 18.
    Acronyms Acronym Definition LDAP LightweightDirectory Access Protocol DN Distinguish Name RDN Relative Distinguished Name DIT Directory Information Tree LDIF LDAP Data Interchange Format DSML Directory Services Markup Language OID Object Identifier SAGE-AU Conf 2003 – p. 18
  • 19.
    Namespaces Hierarchical data structure Entriesare in a tree-like structure called Directory Information Tree (DIT) Consistent view of data - uniform namespace Answers request Refer to server with answer SAGE-AU Conf 2003 – p. 19
  • 20.
    Namespaces - Hierarchal dc=com dc=pisoftware ou=Peopleou=Group uid=bmarshal uid=jparker cn=dev cn=sysadmin SAGE-AU Conf 2003 – p. 20
  • 21.
  • 22.
    Namespaces cont Directory treeis similar to unix file system No root entry in ldap Each entry in ldap can both contain data and be a container In unix, an entry is either a file or a directory - not both LDAP distinguished names are read from bottom to top, unix file systems from top to bottom SAGE-AU Conf 2003 – p. 22
  • 23.
  • 24.
    Global View LDAP Server 1 LDAP Server2 LDAP Server 3 Note each server must contain a subtree SAGE-AU Conf 2003 – p. 24
  • 25.
    Distinguished Names Defined inRFC2253 “Lightweight Directory Access Protocol (v3): UTF-8 String Representation of Distinguished Names” Built up by starting at the bottom, and connecting each level together with commas Contain two parts Left most part is called relative distinguished name Remainder is base distinguished name Eg: uid=bmarshal,ou=People,dc=pisoftware,dc=com RDN is uid=bmarshal Base DN is ou=People,dc=pisoftware,dc=com SAGE-AU Conf 2003 – p. 25
  • 26.
    Distinguished Names cont Ineach base DN, each RDN is unique This ensures no two entries have the same DN dc=com dc=pisoftware dc=sun ou=Peopleou=People Same RDN SAGE-AU Conf 2003 – p. 26
  • 27.
    LDAP Entry Entries arecomposed of attributes Attributes consist of types with one or more values Type describes what the information is Value is the actual information in text format Attributes have a syntax which specifies what type of data - see Schema later on SAGE-AU Conf 2003 – p. 27
  • 28.
    Referrals 1 2 3 4 LDAP Server 1 LDAP Server 2 1.Client requests information 2. Server 1 returns referral to server 2 3. Client resends request to server 2 4. Server 2 returns information to client SAGE-AU Conf 2003 – p. 28
  • 29.
    Aliases Aliases are usedto point one LDAP entry to another Allows you to have structures that aren’t hierarchal Similar in sense to using a symlink in unix Not all LDAP servers support aliases - big performance hit SAGE-AU Conf 2003 – p. 29
  • 30.
    Aliases cont Created by: Entrywith object class of alias Attribute named aliasedObjectName that points to DN of the alias Can use either referrals or putting a LDAP url in an entry SAGE-AU Conf 2003 – p. 30
  • 31.
    Schema Set of rulesthat describes what kind of data is stored Helps maintain consistency and quality of data Reduces duplication of data Ensures applications have consistent interface to the data Object class attribute determines schema rules the entry must follow SAGE-AU Conf 2003 – p. 31
  • 32.
    Schema cont Schema containsthe following: Required attributes Allowed attributes How to compare attributes Limit what the attributes can store - ie, restrict to integer etc Restrict what information is stored - ie, stops duplication etc SAGE-AU Conf 2003 – p. 32
  • 33.
    Objectclass Used to groupinformation Provides the following rules: Required attributes Allowed attributes Easy way to retrieve groups of information Entries can have multiple object classes Required and allowed attributes are the union of the attributes of each of the classes SAGE-AU Conf 2003 – p. 33
  • 34.
    Objectclass inheritance Object classescan be derived from others Extends attributes of other objectclass No multiple inheritance Can’t override any of the rules Special class called top - all classes extend Only required attribute is objectclass Ensures all entries have a objectclass SAGE-AU Conf 2003 – p. 34
  • 35.
    Attributes Attributes have: Name -unique identifier, not case sensitive Object identifier (OID) - sequence of integers separated by dots Attribute syntax: Data attributes can store - eg integer, string etc How comparisons are made If multi valued or single valued SAGE-AU Conf 2003 – p. 35
  • 36.
    Attribute Abbreviations See RFC2256 uidUser id cn Common Name sn Surname l Location ou Organizational Unit o Organization dc Domain Component st State c Country SAGE-AU Conf 2003 – p. 36
  • 37.
    Replication Replication is methodused to keep copy of directory data on multiple servers Increases: Reliability - if one copy of the directory is down Availability - more likely to find an available server Performance - can use a server closer to you Speed - can take more queries as replicas are added Temporary inconsistencies are ok Having replicas close to clients is important - network going down is same as server going down Removes single point of failure SAGE-AU Conf 2003 – p. 37
  • 38.
    Replication Options -Mods to Master LDAP Client Modifications Searches LDAP master (read/write) LDAP slave (read only) Updates replica SAGE-AU Conf 2003 – p. 38
  • 39.
    Replication Options -Referrals LDAP Client LDAP slave (read only)1 2 3 4 5 LDAP master (read/write) 1. Client sends modification to replica 2. Replica returns referral of master to client 3. Client resubmits modification to master 4. Master returns results to client 5. Master updates replica with change SAGE-AU Conf 2003 – p. 39
  • 40.
    Replication Options -Chaining 1 23 4 5 LDAP Master LDAP Slave Client 1. Client sends modification to replica 2. Replica forwards request to master 3. Master returns result to replica 4. Replica forwards result to client 5. Master updates replica SAGE-AU Conf 2003 – p. 40
  • 41.
    Replication - SingleMaster Single master Single server with read-write copy of data Use read-only replicas to handle load of reading and searching Uses referrals or chaining to deal with mods being sent to replicas Obvious single point of failure Simplest to implement SAGE-AU Conf 2003 – p. 41
  • 42.
    Replication - FloatingMaster Floating master Only one server with writeable copy of data at any time If master becomes unavailable, new master is chosen from remaining servers Actual alogorithm used depends on server - usually voting SAGE-AU Conf 2003 – p. 42
  • 43.
    Replication - Cascading Cascadingreplication Master replicates to hub which replays updates to futher servers Helps balance very heavy loads - master can be used for all writes, and pass off all replication to hub Can replicate out to local hubs in geographically disperse topologies - reduces cost Increase performance - put all reads on “bottom” servers SAGE-AU Conf 2003 – p. 43
  • 44.
    Replication - Fractional Fractionalreplication Replicates subsets of attributes Useful for synchronizing from intranet to extranet and removing data for security reasons Can help reduce replication costs by removing unneeded data SAGE-AU Conf 2003 – p. 44
  • 45.
    Replication - Multi-master Multi-master Morethan one server with writable copy of data Servers are responsible for ensuring data propogates Need a conflict resolution policy - most current servers use a last writer wins policy Can have automatic failover when one is unavailable Most complex to implement SAGE-AU Conf 2003 – p. 45
  • 46.
    LDIF LDAP Data InterchangeFormat Represents LDAP entries in text Human readable format Allows easy modification of data Useful for doing bulk changes dump db, run a script over, import back Can use templates for additions Good for backups and transferring data to another system SAGE-AU Conf 2003 – p. 46
  • 47.
    LDIF Cont If attributecontains non-ascii chars, begins with a space, colon or less than, the value is stored in base64 and type separator is :: Can mix plain text and encoded values Can specify URLs, type separator is :< Entries in LDIF are separated with a blank line Continued lines start with spaces Utilities to convert from database to ldif and back slapcat: ldbm database to ldif slapadd: ldif to ldbm database Few non-LDAP related servers know how to deal with it SAGE-AU Conf 2003 – p. 47
  • 48.
    LDIF Example dn: uid=bmarshal,ou=People, dc=pisoftware,dc=com uid:bmarshal cn: Brad Marshall objectclass: account objectclass: posixAccount objectclass: top loginshell: /bin/bash uidnumber: 500 gidnumber: 120 homedirectory: /mnt/home/bmarshal gecos: Brad Marshall,,,, userpassword: {crypt}lDIOnUp17x2jc SAGE-AU Conf 2003 – p. 48
  • 49.
    DSML XML-based file format Canstore both schema and data Can use as generic import/export format for directory data Many existing servers can deal with XML More complex than LDIF Not all LDAP servers support it SAGE-AU Conf 2003 – p. 49
  • 50.
    DSML Example <dsml:dsml xmlns:dsml="http://www.dsml.org/DSML"> <dsml:directory-entries> <dsml:entrydn="uid=bmarshal,dc=example,dc=com" <dsml:objectclass> <dsml:oc-value>top</dsml:oc-value> <dsml:oc-value>account</dsml:oc-value> </dsml:objectclass> <dsml:attr name="cn"> <dsml:value>Brad Marshall</dsml:value> </dsml:attr> <dsml:attr name=loginShell> <dsml:value>/bin/bash</dsml:value> </dsml:attr> </dsml:entry> </dsml:directory-entries> </dsml:dsml> SAGE-AU Conf 2003 – p. 50
  • 51.
    Search Filters Consists of: Baseand scope - what part to search Filter - what criteria attributes must fulfill to be returned Attributes - what attributes to return Prefix notation Standards RFC 1960: LDAP String Representation of Search Filters RFC 2254: LDAPv3 Search Filters SAGE-AU Conf 2003 – p. 51
  • 52.
    Search Filters Operators Basicfilter types Presence Equality Substring Greater-than or equal Less-than or equal Approximate Extensible Joining filters & and | or ! not SAGE-AU Conf 2003 – p. 52
  • 53.
    Search Filter Details Presence Simplechecks for presence of attribute Can return everything by using (objectClass=*) Equality Checks for entries containing given attribute and value Most commonly used search Fastest and easiest to index Case sensitivity depends on attribute syntax SAGE-AU Conf 2003 – p. 53
  • 54.
    Search Filter Detailscont Substring matching Returns entries with values matching given substrings Useful for finding information, eg in white pages etc Not wildcard or regular expression matching Restricted to matching start, middle or end of strings Slower than presence or equality Middle substring matches slower than start or end SAGE-AU Conf 2003 – p. 54
  • 55.
    Search Filter Detailscont Ordered matching (greater-than, less-than) Order determined by attributes syntax and matching rules Approximate filter Algorithm used determined by server Common to have soundex Extensible Allows applying an explicit matching rule to a search filter Not very common, but powerful SAGE-AU Conf 2003 – p. 55
  • 56.
    Search Filters Examples (objectclass=posixAccount) (cn=MickeyM*) (|(uid=fred)(uid=bill)) (&(|(uid=jack)(uid=jill))(objectclass=posixAccount)) SAGE-AU Conf 2003 – p. 56
  • 57.
    Search Scope 3 typesof scope: base limits to just the base object onelevel limits to just the immediate children sub search the entire subtree from base down SAGE-AU Conf 2003 – p. 57
  • 58.
  • 59.
    One Level Scope SAGE-AUConf 2003 – p. 59
  • 60.
  • 61.
    Optimizing Searches Index commonlyaccessed attributes and appropriate filters Reduce opening and closing connections Only request attributes you need Limit the search scope if possible Minimize number of searches - combine searches into one, if possible Minimize updates - writes are slow Use replicas / high availability techniques on the server SAGE-AU Conf 2003 – p. 61
  • 62.
    Operational Attributes Attributes usedby server that usually aren’t displayed Vary by directory vendor Usually time stamps, server access controls, admin information, last updated dates etc SAGE-AU Conf 2003 – p. 62
  • 63.
    Extending Schema To extendschemas, the process is as follows: Obtain Object Identifier (OID) Choose name prefix Create local schema file Define custom attribute types (if necessary) Define custom object classes (Note these examples are from OpenLDAP, others should be similar) SAGE-AU Conf 2003 – p. 63
  • 64.
    Obtaining OID OIDs foundin protocols described by ASN.1, eg SNMP OIDs are hierachical Do not just arbitrarily pick an OID OIDs are obtained from IANA, under Private Enterprise arc at no cost OID from IANA will be something like 1.3.6.1.4.1.X For experiments, OID 1.1 is available (regarded as dead namespace) SAGE-AU Conf 2003 – p. 64
  • 65.
    Choose name prefix Schemaelements all have names Names should be descriptive and not likely to clash Convention is to prefix names with few letters to localize the changes The smaller the organization, the longer the prefix should be Examples are auFirm (Aust company) or comPisoftware (elements for pisoftware.com) SAGE-AU Conf 2003 – p. 65
  • 66.
    Attribute Types andObject Classes attributetype directive used to define new attribute types Uses Attribute Type Description, as per RFC2252 objectclasses directive used to define new object class Uses Object Class Description, as per RFC2252 SAGE-AU Conf 2003 – p. 66
  • 67.
    Attribute Type Description AttributeTypeDescription= "(" whsp numericoid whsp ; AttributeType identifier [ "NAME" qdescrs ] ; name used in ; AttributeType [ "DESC" qdstring ] ; description [ "OBSOLETE" whsp ] [ "SUP" woid ] ; derived from this ; other AttributeType [ "EQUALITY" woid ; Matching Rule name [ "ORDERING" woid ; Matching Rule name [ "SUBSTR" woid ] ; Matching Rule name SAGE-AU Conf 2003 – p. 67
  • 68.
    Attribute Type Descriptioncont [ "SYNTAX" whsp noidlen whsp ] [ "SINGLE-VALUE" whsp ] ; default multi-valued [ "COLLECTIVE" whsp ] ; default not collective [ "NO-USER-MODIFICATION" whsp ] ; default user modifiable [ "USAGE" whsp AttributeUsage ] ; default userApplications whsp ")" AttributeUsage = "userApplications" / "directoryOperation" / "distributedOperation" / "dSAOperation" SAGE-AU Conf 2003 – p. 68
  • 69.
    Attribute Type Example attributetype( 2.5.4.41 NAME ’name’ DESC ’names associated with the object’ EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{32768} ) attributetype ( 2.5.4.4 NAME ( ’sn’ ’surname’ ) DESC ’surnames associated with the object’ SUP name ) SAGE-AU Conf 2003 – p. 69
  • 70.
    Object Class Description ObjectClassDescription= "(" whsp numericoid whsp ; ObjectClass identifier [ "NAME" qdescrs ] [ "DESC" qdstring ] [ "OBSOLETE" whsp ] [ "SUP" oids ] ; Superior ObjectClasses [ ( "ABSTRACT" / "STRUCTURAL" / "AUXILIARY" ) whsp ] ; default structural [ "MUST" oids ] ; AttributeTypes [ "MAY" oids ] ; AttributeTypes whsp ")" SAGE-AU Conf 2003 – p. 70
  • 71.
    Object Class Example objectclass( 1.3.6.1.1.1.2.0 NAME ’posixAccount’ SUP top AUXILIARY DESC ’Abstraction of an account with POSIX attributes’ MUST ( cn $ uid $ uidNumber $ gidNumber $ homeDirectory ) MAY ( userPassword $ loginShell $ gecos $ description ) ) SAGE-AU Conf 2003 – p. 71
  • 72.
    LDAP Protocol Uses clientserver model Message oriented protocol - client sends messages to server and gets replies Can issue multiple requests at once - each response has message id to identify 9 basic protocol operations - interrogation, update and authentication LDAPv3 provides extended operations and controls Uses simplified version of Basic Encoding Rules (BER) - not plain text SAGE-AU Conf 2003 – p. 72
  • 73.
    LDAP Protocol Operations Interrogationoperations search compare Update operations add delete modify rename Authentication and control operations bind unbind abandon SAGE-AU Conf 2003 – p. 73
  • 74.
    Typical LDAP conversation ClientServer Open connection and bind Result of bind operation Search operation Returned entry 1 Returned entry 2 Results of search operation Unbind operation Close connection SAGE-AU Conf 2003 – p. 74
  • 75.
    Bind Operations How clientauthenticates to directory Opens TCP connection, gives distinguished name and credentials Server checks credentials are correct, returns result to client If credentials fail, returns an anonymous bind Authentication lasts while connection is open, or until client reauthenticates Credentials can be password, digital certificate or other SAGE-AU Conf 2003 – p. 75
  • 76.
    Authentication Levels There are3 basic levels of authentication: Anonymous - no username and password Enabled by default, disable using “disallow bind_anon” in slapd.conf Unauthenticated - only username (sometimes called reference bind) Disabled by default, enable using “allow bind_anon_cred” in slapd.conf Authenticated - username and correct password Enabled by default, disable using “disallow bind_anon_simple” in slapd.conf SAGE-AU Conf 2003 – p. 76
  • 77.
    LDAP Security Model Authentication Howto verify identities Password policies Criteria passwords must satisfy to be valid - ie, length, age etc Encryption Ensuring data is private Access control Who can access what data Auditing Determine if security model is being followed - ie, logs SAGE-AU Conf 2003 – p. 77
  • 78.
    Security Model -Authentication Anonymous access Simple password Proxy authentication Simple password over encrypted connection Certificate based authentication SASL based authentication SAGE-AU Conf 2003 – p. 78
  • 79.
    Password policies Minimum length Maximumage Syntax checking History keeping Expiration policy Account lockout policy SAGE-AU Conf 2003 – p. 79
  • 80.
    Access Control Set permissionson: Entire directory Subtree Specific entries Specific attributes Any entry that matches a search filter SAGE-AU Conf 2003 – p. 80
  • 81.
    LDAP URLs Definition takenfrom RFC2255 <ldapurl> ::= "ldap://" [ <hostport> ] "/" <dn> [ "?" <attributes> [ "?" <scope> "?" <filter> ] ] <hostport> ::= <hostname> [ ":" <portnumber> ] <dn> ::= a string as defined in RFC 1485 <attributes> ::= NULL | <attributelist> <attributelist> ::= <attributetype> | <attributetype> [ "," <attributelist> ] <attributetype> ::= a string as defined in RFC 1777 <scope> ::= "base" | "one" | "sub" <filter> ::= a string as defined in RFC 1558 SAGE-AU Conf 2003 – p. 81
  • 82.
    LDAP URLs DN Distinguishedname Attribute list List of attributes you want returned Scope base base object search one one level search sub subtree search Filter Standard LDAP search filter SAGE-AU Conf 2003 – p. 82
  • 83.
  • 84.
    LDAP Related StandardsBodies Consortiums and Standard Bodies OASIS Directory Services Markup Language Distributed Management Task Force (DMTF) Common Informational Model (CIM) Network Applications Consortium (NAC) Users Group Open Group Directory Interoperability Forum (DIF) LDAP2000 Interoperability Internet Engineering Task Force (IETF) LDAP Standards SAGE-AU Conf 2003 – p. 84
  • 85.
    IETF Working Groups IETFWorking Groups LDAPExt Access Controls APIs LDUP Replication LDAPbis LDAPv3 Protocol revisions SAGE-AU Conf 2003 – p. 85
  • 86.
    LDAPv3 Internationalization - usingUTF-8 Referrals and Continuations Security Authentication via SASL Integrity and Confidentiality Protection via TLS or SSL Extensibility Feature and schema discovery LDAPv3 servers have a directory entry called root DSE (Directory Server Entry) Contains: protocol supported, schemas, other useful info SAGE-AU Conf 2003 – p. 86
  • 87.
    Directory Uses 3 mainuses of directories Network directory Provides user account management Enterprise directory Global repository for shared information Details about people, organisations and devices Business directory Details about trading partners, customers, suppliers etc SAGE-AU Conf 2003 – p. 87
  • 88.
    Directory Life Cycle 3main parts to life cycle: Design Understand directory requirements and gather data Deployment Actually try out directory Maintenance Update data, keep service running, and improve SAGE-AU Conf 2003 – p. 88
  • 89.
    Design Cycle Directory needs Understandwhat applications require Data Find existing data sources Determine relationship to directory Schema Develop schemas for applications requirements Namespace Organise data layout SAGE-AU Conf 2003 – p. 89
  • 90.
    Design Cycle cont Topology Determinewhere servers are located Determine how data is divided Replication Ensure data is available where it is needed Security Essential to meeting security and privacy requirements of users SAGE-AU Conf 2003 – p. 90
  • 91.
    Deployment Cycle Choose directorysoftware Evaluate and choose software Piloting Inital testing to check design Performance and scaling testing Testing to see if system can handle the task Tuning Check process as well as technical User feedback Expose users to test system Going into production Move from pilot to production SAGE-AU Conf 2003 – p. 91
  • 92.
    Maintenance Cycle Data maintenance Keepingdata up to date Data backups Ensure backups don’t interfer with operations Replication can help here Schema additions Extend schemas when adding new applications Monitoring Integrate with existing system if possible Expansion Try to plan for expansion - growth may surprise you Changing requirements Don’t get caught out SAGE-AU Conf 2003 – p. 92
  • 93.
    Directory Management Directory managementconsists of: Namespace and directory tree design Determine root naming context Integration with existing data Synchronization Maintaining data Choosing mangement model SAGE-AU Conf 2003 – p. 93
  • 94.
    Basic Design Steps Defineapplications for directory Find data sources and relationships Schema design Namespace design and topology Replication Extraction and population Testing and deployment SAGE-AU Conf 2003 – p. 94
  • 95.
    Schema Design Be awareof existing schemas and use them if possible Use schemas provided with applications Define and document any new schemas required Be prepared for schema evolution as things change SAGE-AU Conf 2003 – p. 95
  • 96.
    Namespace Design Designing anamespace is Hard Requires indepth knowledge of what the directory will be used for Hard to reorganise once data is put in - requires downtime, etc Needs to support applications that want to use it - be aware of existing standards SAGE-AU Conf 2003 – p. 96
  • 97.
    Namespace Design cont Trynot to break out into different departments - what happens when person moves? Avoid designs that will have to change - eg, don’t base on org chart Don’t go overboard - too much hierachy can get confusing Probably won’t get it right first - will take some iterations SAGE-AU Conf 2003 – p. 97
  • 98.
    Namespace Design cont Goodnamespace design helps with: Delegation of authority Replication of data Security and access control Scalability Physical placement of servers SAGE-AU Conf 2003 – p. 98
  • 99.
    Tree Design 3 mostcommonly used tree designs for a single company Organizational Flat Geographical SAGE-AU Conf 2003 – p. 99
  • 100.
    Organizational Based Tree dc=pisoftware dc=com ou=Sales ou=Develou=Sysadmin ou=People ou=Groups ou=Apps SAGE-AU Conf 2003 – p. 100
  • 101.
    Organizational Based Details Mirrorsorganizational structure Good for using delegated administration management model People changing jobs mean a change to distinguished name Groups refer to distinguished names - no referential integrity checking SAGE-AU Conf 2003 – p. 101
  • 102.
    Flat Tree dc=pisoftware dc=com ou=People ou=Groupsou=Apps SAGE-AU Conf 2003 – p. 102
  • 103.
    Flat Details Simplest layout- all people and groups are in one level down from root Entries only added or removed on hiring and firing - not internal job changes Most directory servers can’t split single branch across multiple servers Harder to delegate admin control SAGE-AU Conf 2003 – p. 103
  • 104.
  • 105.
    Geographical Details Branch foreach geographical location of the company Each geographical location has a master, also replicates rest of tree Rarer for people to move between geographical locations Geographical dispersement of company might not match political SAGE-AU Conf 2003 – p. 105
  • 106.
    Choosing Root NamingContext Root naming context is servers top level entry Some servers can have multiple root naming contexts Two main choices: Traditional Domain component Active Directory doesn’t give a choice for root naming context, most others do SAGE-AU Conf 2003 – p. 106
  • 107.
    Traditional Style Traditionally hasbeen ‘o=company,c=country’ Company is free-form string of company name Country is ISO 2 letter country code Inherited from X.500 Can cause conflicts between similarly named companies SAGE-AU Conf 2003 – p. 107
  • 108.
    Domain Component Style UseDNS name to generate base DN See RFC2377 for more details - "Naming Plan for Internet Directory-Enabled Applications" example.com gives dc=example,dc=com Already globally unique Already registered Can trace back to who owns it easily Some CAs only allow traditional X.500 attributes, which doesn’t include dc SAGE-AU Conf 2003 – p. 108
  • 109.
    Topology Design Directory treecan be spread over multiple physical servers Design is important to: Increase performance Increase availability Better manage directory Hold more entries than a single server could Users see one large directory Closely related to replication design SAGE-AU Conf 2003 – p. 109
  • 110.
    Topology Design Each serveris delegated a partition of the directory Similar to DNS One server is the root and is common ancestor to all subpartitions Partitions must be a complete subtree, and not exclude any entries Servers can hold more than one partition, eg read-only copies SAGE-AU Conf 2003 – p. 110
  • 111.
    Topology Design -References Directory glued together using knowledge references Immediate superior knowledge references Points up the tree Hooks back up to ancestor Subordinate knowledge references Points down the tree to other partitions Hook to hang other partitions off SAGE-AU Conf 2003 – p. 111
  • 112.
    Topology Design -Why Partition Too many entries for a single server Increase performance and scalability Applications mostly read and modify entries in local section of tree Replication traffic to a single partition is too large If partitioning allows traffic to remain local, won’t have to cross slow WAN links If directory use will rapidly expand SAGE-AU Conf 2003 – p. 112
  • 113.
    Topology Design -Why Not Partition All entries can fit on a single server Applications modify entries across whole tree Not much replication traffic Organisation is centrally located, no slow WAN links Directory use is static and won’t exceed capabilities of single server SAGE-AU Conf 2003 – p. 113
  • 114.
    Topology Design -Considerations Consider directory enabled applications and performance requirements Understand server software limitations and capabilities Consider physical layout of network and location of applications Ensure namespace design fits within constraints - ie, flat namespace isn’t good for partitioning SAGE-AU Conf 2003 – p. 114
  • 115.
    Replication Design Increases reliabilityand performance Allows locating data close to users and applications that need them Can manage data where it is being used Gives redundancy - applications can fail over to replicas Can distribute load across multiple servers, increasing performance Closely related to topology design SAGE-AU Conf 2003 – p. 115
  • 116.
    Replication Design Strategy Highavailability Multiple directories at one site Use multi-master to ensure write-failover Local availability Replicas at local offices Useful if network links are unreliable or intermittant Helps reduce load on master server Masters can be at: Central office Local server is master for local part of directory tree SAGE-AU Conf 2003 – p. 116
  • 117.
    Replication Design Strategycont Disaster recovery Two masters at geograhically disperse locations Provides failover and data protection Load balancing Spread user connections over servers Dedicate servers to read-only activities Dedicate servers to particular activities - ie, server for mail SAGE-AU Conf 2003 – p. 117
  • 118.
    Replication Issues toConsider Quality of links between remote sites Amount of bandwidth between sites Is replication traffic too much for link Physical location of users How many users What type of work they do Number of applications Type and proportion of operations done Size of directory SAGE-AU Conf 2003 – p. 118
  • 119.
    Management Models 3 mainmanagement models Centralized administration Distributed administration User self-administration SAGE-AU Conf 2003 – p. 119
  • 120.
    Centralized Administration Good forsmaller organisations All changes are made in the one location or group of people Minimal admin infrastruture Low potential for duplication of data Can cause bottlenecks in changes being made - long delays Often seen as most secure - not always the case Possibly too much trust in central group Within sub-departments, possibility that changes may not happen quickly enough - eg, employee is fired and notification takes time to make it to central accounts department SAGE-AU Conf 2003 – p. 120
  • 121.
    Distributed Administration Centralised departmentco-ordinates sub-groups, who do actual admin work Reduces admin bottlenecks Very scalable Similar to how DNS admin is done - root nameservers handle top level, then delegated out Namespace design is important - hard to distribute across flat namespace SAGE-AU Conf 2003 – p. 121
  • 122.
    User Self-Administrated User createsand manages own account - eg Internet shopping Web forms often used to let end users admin own accounts Common to seperate end user admined accounts from other part of directory Lower level of trust of data done this way Usually use other form of data / contact - eg frequent flyers database, using email address SAGE-AU Conf 2003 – p. 122
  • 123.
    Data Maintenance Maintenance ismost important part Usually involved with maintance the longest, often least though about aspect Configuration is comparitively simple, managing contents is hard The best designed directory is useless with out of date or incomplete data SAGE-AU Conf 2003 – p. 123
  • 124.
    Managing Directory Contents Peoplecan have multiple accounts, or a single account (or group) can have multiple people associated Need to manage association between accounts and people, as well as managing the people This is essential to be able to terminate all accounts associated with a terminated employee Important as ldap doesn’t ensure referential integrity - can be left with dangling references SAGE-AU Conf 2003 – p. 124
  • 125.
    Managing Data Flow Managingdata integration between directories has a number of approaches: Replication Data export/import Scripting Metadirectories Virtual Directories SAGE-AU Conf 2003 – p. 125
  • 126.
    Replication Exactly duplicating databetween directories This creates a copy of data for distribution, performance, scalability and redundancy No LDAP standard for replication, so hard to replicate between different vendors IETF is developing LDUP, an independant replication protocol SAGE-AU Conf 2003 – p. 126
  • 127.
    Data export/import Export dataout from one directory, then import into next Can manipulate data after exporting Servers must support either of 2 main standards LDIF DSML Updates only happen periodically, data is out of sync between these times SAGE-AU Conf 2003 – p. 127
  • 128.
    Scripting Writing scripts tomanipulate data between servers Allows choosing subset of data to transfer Easy to change / manipulate data Common languages are Perl, Java and C SAGE-AU Conf 2003 – p. 128
  • 129.
    Metadirectories Consolidates subsets ofdata from various locations Presents it as LDAP, XML, HTTP etc Consolidates and aggregates details about objects Can provide multiple views of data Helps manage relationships between directories Manages data flow between directories Can reflect information back to original or new data sources Not just a consolidated directory of all information SAGE-AU Conf 2003 – p. 129
  • 130.
    Metadirectories cont Consists of: Metadirectorynamespace Join engine Connectors Comes in two different forms Add on to existing directory Stand alone directory SAGE-AU Conf 2003 – p. 130
  • 131.
    Metadirectories Namespace Also calledmeta view Unified view of underlying directories / data sources Usually stored in a LDAP directory Uses join engine to synchronize underlying sources SAGE-AU Conf 2003 – p. 131
  • 132.
    Metadirectories Join Engine Manageddata flow between external sources and metadirectory views Defines authoritive source for each bit of data Controls which data sources can be changed via meta directory Manipulates and unifies connector views to provide meta view Links items in connector views with items in meta view Can construct attributes from other values SAGE-AU Conf 2003 – p. 132
  • 133.
    Metadirectories Connectors Provides datafrom external sources to join engine Connects between directory and data sources Can provide name mapping to translate from original data source to LDAP Defines which attributes to use or discard Provides a connector view Two types: Direct connector: talks directly to source, usually either LDAP or SQL Indirect connector: converts from source data into LDAP SAGE-AU Conf 2003 – p. 133
  • 134.
    Virtual Directories LDAP frontendto databases / directories Provides schema adaptors Failover and load balancing Namespace conversions Value manipulations Add/modify/delete attributes Remove or construct attributes based on criteria SAGE-AU Conf 2003 – p. 134
  • 135.
    Data Flow Analysis Schemamapping Mapping schemas between directories Determining authoritative source Find which directory has most up to date for each part of data Data tranformation Not all systems store data in the same format, eg may use extra lookup tables Change data representation to be the same format in each directory Namespace translation Sometimes can’t translate directly - can get conflicts Sometimes can just change root naming context SAGE-AU Conf 2003 – p. 135
  • 136.
    Data Sources Existing directoryservices Operating systems Existing databases Flat files or spreadsheets Applications Sysadmins End users SAGE-AU Conf 2003 – p. 136
  • 137.
    Common Data Problems Thingsto be careful of: Too much information - can’t find what is needed Not enough information Poor quality information Out of date information SAGE-AU Conf 2003 – p. 137
  • 138.
    Tips for Success Carefullypick and stick to scope of project Start small, show incremental successes Pick low hanging fruit, and stay visible Deploy in parallel with existing systems Design for end result - doesn’t have to get there straight away Identify who’s responsible early Use info with greatest value first Allow time for political and process issues Be careful what you promise and manage expectations SAGE-AU Conf 2003 – p. 138
  • 139.
    Important RFCs RFC Title RFC2247Using Domains in LDAP DNs RFC2251 LDAPv3 Protocol RFC2252 LDAPv3 Attribute Types RFC2253 LDAPv3 Disinguished Name RFC2254 LDAPv3 Search Filters RFC2255 LDAPv3 URL Format RFC2256 A Summary of the X.500(96) User Schema RFC2307 LDAP Network Information Services Schema RFC2377 LDAP Naming Plan SAGE-AU Conf 2003 – p. 139
  • 140.
    Important RFCs cont RFCTitle RFC2798 LDAP inetOrgPerson schema RFC2829 LDAPv3: Authentication Methods RFC2830 LDAPv3: Start TLS RFC2849 LDIFv1 RFC2891 LDAPv3: Server Side Sorting of Search Results RFC3112 LDAP Authentication Password Schema RFC3377 LDAP(v3): Technical Specification SAGE-AU Conf 2003 – p. 140
  • 141.
    References Understanding and DeployingLDAP Directory Services Timothy A. Howes, Mark C. Smith and Gordon S. Good Macmillan Network Architecture and Development Series Implementing LDAP Mark Wilcox Wrox Press Ltd LDAP Programming, Management and Integration Clayton Donley Manning Publications SAGE-AU Conf 2003 – p. 141
  • 142.
    References cont Summary Reportfrom Catalyst 99 Directory Namespace and Best Practices Workshop, The Burton Group and The Network Applications Consortium OpenLDAP 2.1 Administrators Guide, http://www.openldap.org/doc/admin21/ LDAP Linux HOWTO, Luiz Ernesto Pinheiro Malere, Linux Documentation Project LDAP Implementation HOWTO, Roel van Meer, Linux Documentation Project SunONE Directory Server 5.2 Deployment Guide SunONE Meta Directory Server 5.1 Deployment Guide The Slapd and Slurpd Administrator’s Guide, University of Michigan, Release 3.3 SAGE-AU Conf 2003 – p. 142