HP UX Direry Server Introduction to Directory Server, About Ldap, Overview of the server frontend

Page 10

1.1.2 About LDAP

LDAP provides a common language that client applications and servers use to communicate with one another. LDAP is a "lightweight" version of the Directory Access Protocol (DAP) described by the ISO X.500 standard. DAP gives any application access to the directory through an extensible and robust information framework but at a high administrative cost. DAP uses a communications layer that is not the Internet standard protocol and has complex directory-naming conventions.

LDAP preserves the best features of DAP while reducing administrative costs. LDAP uses an open directory access protocol running over TCP/IP and simplified encoding methods. It retains the data model and can support millions of entries for a modest investment in hardware and network infrastructure.

1.2 Introduction to Directory Server

HP-UX Directory Server includes the directory itself, the server-side software that implements the LDAP protocol, and a client-side graphical user interface that allows end-users to search and change entries in the directory.

Without adding other LDAP client programs, Directory Server can provide the foundation for an intranet or extranet. Every Directory Server and compatible server applications use the directory as a central repository for shared server information, such as employee, customer, supplier, and partner data.

Directory Server can manage user authentication, create access control, set up user preferences, and centralize user management. In hosted environments, partners, customers, and suppliers can manage their own portions of the directory, reducing administrative costs.

When Directory Server is installed and set up, the following components are installed:

•The core Directory Server LDAP server, the LDAP v3-compliant network daemon (ns-slapd) and all the associated plug-ins, command-line tools for managing the server and its databases, and its configuration and schema files. For more information about the command-line tools, see the HP-UX Directory Server configuration, command, and file reference.

•Administration Server, a web server which controls the different portals that access the LDAP server. For more information about the Administration Server, see Using the Admin Server.

•Directory Server Console, a graphical management console that dramatically reduces the effort of setting up and maintaining the directory service. For more information about the Directory Server Console, see HP-UX Directory Server console guide.

•Web applications such as Admin Express that allow users to search for information in the Directory Server, in addition to providing access to their own information, including password changes, to reduce user support costs.

•SNMP agent to monitor the Directory Server using the Simple Network Management Protocol (SNMP). For more information about SNMP monitoring, see the HP-UX Directory Server administrator guide.

1.2.1Overview of the server frontend

Directory Server is a multithreaded application. This means that multiple clients can bind to the server at the same time over the same network. As directory services grow to include larger numbers of entries or geographically-dispersed clients, they also include multiple Directory Servers placed in strategic places around the network.

The server frontend of Directory Server manages communications with directory client programs. Multiple client programs can communicate with the server using both LDAP over TCP/IP (Internet traffic protocols) and LDAP over Unix sockets (LDAPI). The Directory Server can establish a secure (encrypted) connection with SSL/TLS, depending on whether the client negotiates the use of Transport Layer Security (TLS) for the connection.

10 Introduction to directory services

Page 9 Page 11
Image 10
Page 9 Page 11
Contents HP-UX Directory Server deployment guide Page Table of Contents Designing the directory tree Designing the replication process 103 141 125145 155 About directory services Introduction to directory servicesAbout global directory services About Ldap Introduction to Directory ServerOverview of the server frontend Server plug-ins overview Overview of the basic directory treeDirectory Server data storage Expanded directory tree for example corpDistributing directory data Directory design overviewAbout directory entries Performing queries on directory entriesDesign process outline Deploying the directoryOther general directory resources Page Information to include in the directory Planning the directory dataIntroduction to directory data Information to exclude from the directoryDefining directory needs Performing a site surveyIdentifying the applications that use the directory Identifying data sources Characterizing the directory dataDetermining level of service Considering a data masterDetermining data ownership Determining data access Example Tabulating data ownership and access Documenting the site surveyRepeating the site survey Page Standard schema Designing the directory schemaSchema design process overview Schema formatStandard attributes Standard object classes Syntaxes support in Directory ServerViewing the default directory schema Mapping the data to the default schemaMatching data to schema elements Customizing the schema Data mapped to default directory schemaNaming attributes and object classes When to extend the schemaGetting and assigning object identifiers Strategies for defining new object classesNew object classes appear in LDAPv3 schema format as follows Creating custom schema files Deleting schema elementsStrategies for defining new attributes Custom schema best practices Naming schema filesDefining schema in a single file Maintaining consistent schemaUsing user defined as the origin Defining attributes before object classesMaintaining consistency in replicated schema Schema checkingSelecting consistent data formats Other schema resources Designing the directory tree Designing the directory treeIntroduction to the directory tree Choosing a suffixSuffix naming conventions Naming multiple suffixesCreating the directory tree structure Branching the directoryIdentifying branch points Example environment directory treeDirectory tree for example isp Replication considerations Initial branching of the directory tree for example corpAccess control considerations Directory branching for example ispNaming Entries Naming person entriesNaming group entries Naming organization entriesAbout roles Grouping directory entriesNaming other kinds of entries About class of service Deciding between roles and groupsVirtual directory information tree views About virtual DIT views10 Examples of a flat and an organizationally-based DIT 11 a combined DIT using views Advantages of using virtual DIT views 12 a DIT with a virtual DIT view hierarchyExample of virtual DIT views Effects of virtual views on performance Views and other directory featuresCompatibility with existing applications Directory tree design examples Directory tree for an international enterpriseOther directory tree resources Directory tree for an ISPPage Topology overview Designing the directory topologyDistributing the directory data About using multiple databases Storing suffix data in separate databasesAbout suffixes Directory tree spread across multiple databasesUsing referrals About knowledge referencesAbout default referrals Structure of an Ldap referralUsing smart referrals to redirect requests Smart referralsRedirecting a query to a different server and namespace Tips for designing smart referrals 10 a circular referral patternUsing chaining Deciding between referrals and chainingEvaluating access controls Usage differencesThis illustration, the following steps are performed Using indexes to improve database performance Overview of directory index typesEvaluating the costs of indexing Page Replication concepts Designing the replication processIntroduction to replication Unit of replicationSuppliers and consumers Read-write and read-only replicasReplication and changelogs Data consistency Common replication scenariosReplication agreement Single-master replication Multi-master replicationMulti-master replication configuration two suppliers Multi-master replication configuration B four suppliers Cascading replication Replication traffic in a multi-master environmentCascading replication scenario Mixed environments Replication traffic and changelogs in cascading replicationDefining a replication strategy Combined multi-master and cascading replicationConducting a replication survey Replicated selected attributes with fractional replicationReplication resource requirements Managing disk space required for multi-master replicationUsing replication for high availability Replication across a wide-area networkUsing replication for local availability Using replication for load balancingExample of network load balancing Effects of replication and remote lookup on the networkExample of load balancing for improved performance Calculating Directory Server loadExample replication strategy for a small site Example replication strategy for a large siteReplication and Directory Server plug-ins Using replication with other Directory Server featuresReplication and access control Replication and database linksSchema replication See Creating custom schema files for more informationReplication and synchronization Windows synchronization overview Designing synchronizationSynchronization agreements Controlling synchronization Planning windows synchronizationChangelogs Resource requirementsManaging disk space for the changelog Defining the connection typeDetermining the subtree to synchronize Interaction with a replicated environmentIdentifying the directory data to synchronize Multi-master Directory Server Windows domain synchronizationDefining an update strategy Synchronizing passwords and installing password servicesEditing the sync agreement NtUserDomainId Password policies Values for cn attributesValues for street and streetAddress Contraints on the initials attributeNtGroupId Name About security threats Unauthorized accessDesigning a secure directory Unauthorized tamperingDetermining access rights Denial of serviceAnalyzing security needs Conducting regular audits Overview of security methodsEnsuring data privacy and integrity Example security needs analysisSelecting appropriate authentication methods Anonymous accessSimple password Simple authentication and security layer Certificate-based authenticationSimple password over SSL/TLS Proxy authenticationDesigning a password policy Preventing authentication by account deactivationHow password policy works Designing a secure directory Designing a password policy Password policy checking process Password change after reset Password policy attributesUser-defined passwords Password syntax checking Password expirationGrace login limit Expiration warningPassword minimum age Password lengthPassword history Password storage schemes Designing a password policy in a replicated environmentDesigning an account lockout policy Designing access control About the ACI formatTargets PermissionsBind rules Setting permissionsAllowing or denying access Precedence ruleWhere to place access control rules When to deny accessUsing filtered access control rules Viewing ACIs Get effective rights Using ACIs Some hints and tricks Database encryption Use Ldap search filters cautiouslySecuring server to server connections Other security resourcesDesign example a local enterprise Local enterprise schema designDirectory design examples Local enterprise data designLocal enterprise directory tree design Local enterprise topology design Database topologyLocal enterprise replication design Supplier architectureSupplier consumer architecture Supplier architecture for Example CorpLocal enterprise security design Supplier and consumer architecture for Example CorpDesign example a multinational enterprise and its extranet Local enterprise tuning and optimizationsLocal enterprise operations decisions Multinational enterprise data design Multinational enterprise schema designMultinational enterprise directory tree design Entry for the l=Asia entry appears in Ldif as follows Multinational enterprise topology design Directory tree for Example Corp. Internationals extranetServer topology 11 Server topology for Example Corp. Europe Multinational enterprise replication design 12 Server topology for Example Corp. Internationals extranet13 Supplier architecture for Example Corp. Europe Multinational enterprise security design Directory design examples Contacting HP Support and other resourcesRelated information HP-UX Directory Server administration server guide HP-UX documentation setTroubleshooting resources Typographic conventions144 Access rights GlossaryCGI DIT GSS-API Ldap NIS PTA Sasl TCP/IP 154 Index Index OID Sasl 159
Related manuals
Manual 96 pages 26.31 Kb Manual 68 pages 26.36 Kb Manual 18 pages 3.79 Kb Manual 72 pages 14.95 Kb

UX Direry Server specifications

HP UX Directory Server is a robust and scalable solution designed for managing directory information within enterprise networks. Developed by Hewlett-Packard (HP), this server offers an extensive set of features tailored to meet the needs of organizations that require an efficient way to store, manage, and retrieve identity and access data.

One of the key features of HP UX Directory Server is its ability to handle large directories with significant volumes of data. Built on a highly optimized architecture, it provides excellent performance and can support millions of entries without sacrificing speed or reliability. This capability makes it an ideal choice for large-scale deployments in enterprises that require high availability and responsiveness.

In addition to its scalability, HP UX Directory Server supports a wide range of protocols, including LDAP (Lightweight Directory Access Protocol), which ensures seamless integration with diverse applications and systems across various platforms. The server maintains standards compliance, which facilitates interoperability and simplifies administration tasks.

Security is a top priority for HP UX Directory Server, offering an array of features to protect sensitive information. It supports secure data transmission via TLS/SSL protocols, ensuring encrypted communication between clients and servers. Advanced access controls allow administrators to define fine-grained permissions, helping to safeguard directory data against unauthorized access.

Another salient feature of HP UX Directory Server is its replication capabilities. The server can replicate directory data across multiple instances, ensuring data consistency and availability in distributed environments. This feature is essential for businesses operating across different geographical locations or requiring failover solutions for disaster recovery.

HP UX Directory Server also comes equipped with tools for data management, including an intuitive administration console for configuring and monitoring the server. Additionally, it offers customizable schema capabilities, enabling organizations to tailor the directory structure to fit their specific needs.

Integration with existing identity management solutions is streamlined through connectors and APIs, allowing organizations to extend their directory services and enhance user experience.

In summary, HP UX Directory Server is a powerful directory management solution that combines scalability, security, and integration flexibility. Its support for industry standards, advanced replication, and comprehensive administrative tools makes it an essential asset for organizations seeking to manage identity and access efficiently. By leveraging this technology, businesses can improve their operational efficiency and ensure a secure and organized approach to directory management.
Top Page Image Contents