HP UX Kerberos Data Security Software manual Introduction to Ldap

Kerberos Server is based on distributed client-server architecture. It ensures secure communication in a networked environment by leveraging individual trust relationships. It then distributes that trust across enterprise-wide, distributed client-server networks. It contains a GUI for configuration purposes.

Users can choose to configure the Kerberos Server v3.1 with a native (C-Tree) backend database or with an LDAP backend database.

Introduction to LDAP

Lightweight Directory Access Protocol (LDAP) is an Internet protocol that email programs use to look up contact information on a server. LDAP was designed at the University of Michigan to adapt a complex enterprise directory system (called X.500) to the modern Internet. X.500 is too complex to support on desktops and over the Internet, so LDAP was created to provide the same service. LDAP has broader applications such as looking up services and devices on the Internet (and intranets).

LDAP-enabled directories are becoming the defacto corporate standard to reduce user management cost. LDAP gained a lot of popularity with the explosive growth of the Internet and World Wide Web. LDAP-based directory servers are used to store the enterprise user and service information as well as the customer relationship information for e-commerce applications.

Kerberos Server on HP-UX with Native Back End

If you choose to use Kerberos Server with a native C-Tree back end, Kerberos Server maintains complete information for all the principals with their keys in a database on the machine on which the Kerberos server is configured. The native C-Tree database is used as the default backend database on the Kerberos Server v3.1.

Kerberos Server on HP-UX with LDAP Back End

Kerberos Server can also be configured with LDAP as the back end. If you choose to use LDAP, user information is stored in the LDAP directory in a centralized location. HP-UX users can log in to the system by accessing the user information from the LDAP directory with the help of LDAP-UX Integration product.

Benefits of an LDAP Back End

As the number of different networks and applications has grown, the number of specialized directories of information has also grown, resulting in islands of information that are difficult to maintain. LDAP, an open industry standard, has evolved to meet these needs by providing access to a common directory infrastructure. LDAP defines a standard method for accessing and updating information in a single directory.

By integrating the Kerberos principals with the corresponding users in an LDAP directory, you can create a single point of user and group management. This simplifies account administration by allowing user administration to be performed from a single location.

Implementing this solution involves the following steps:

•Modify the configuration files on the Kerberos Server

•Extend the LDAP directory schema

Integrating the Kerberos Principal into the LDAP Directory

A directory contains entries which are organized in a tree structure called the Directory Information Tree (DIT). Entries are arranged within the DIT based on their Distinguished Names (DN). DN is a unique name that unambiguously identifies a single entry. DNs are made up of a sequence of relative distinguished names (RDNs). Each RDN in a DN corresponds to a branch in the DIT leading from the root of the DIT to the directory entry. A DN is composed of a sequence of RDNs separated by

commas, such as cn=alex, ou=Sales, o=bambi.com.

Figure 3 shows how a Kerberos principal is integrated in to the LDAP directory.