01 February 2002 Directories are Fundamental Keith Hazelton, Senior IT Architect University of...

01 February 2002

Directories are FundamentalDirectories are Fundamental

Keith Hazelton, Senior IT Architect

University of Wisconsin-Madison

Keith Hazelton, Senior IT Architect

University of Wisconsin-Madison

01-Feb-02 2

Directories are Fundamental: Outline

• Sketch: A minimal, idealized enterprise directory

• What its features will buy you

• Divergences from the ideal that will cost you

• Policy matters

• A dip into directory internals

• Working with applications and with other directories

01-Feb-02 3

A minimal, idealized enterprise directory—Start from scratch

StdntSys

HR Faculty and staff Students

Services we want to provide to people as members or affiliates of the community

01-Feb-02 4


StdntSys



Sys-specific data => Institutional informationIdentity management

Registry

01-Feb-02 5


StdntSys




Registry

LDAP server Directory

01-Feb-02 6


StdntSys




Registry


01-Feb-02 7


StdntSys




Registry


Other populations

01-Feb-02 8

A minimal, idealized enterprise directory—Challenges

• If people enter the population by more than one path, Identity management required

• Informational basis for same/not same person judgment

• Processes to manage exceptions

• An attractive alternative: A single shared Registration Authority service

• Anyone have such a thing in operation?

01-Feb-02 9

A minimal, idealized enterprise directory—Contents

• Basic demographic data

• Contact information

• Affiliation/role attributes

• Person’s identifiers in associated systems

01-Feb-02 10

What its features will buy you

• The Enterprise Directory supports operations over the whole population

• Single authentication namespace (“NetID”)• Data walkabouts• Application specific directories can stay specific by

linking rather than synching• Provisioning

01-Feb-02 11

What its features will buy you

• Business Case for Dir plus Security Middleware

• See Early Harvest work for full document• Reduced number of credentials• Shorter waiting period for service activation• Shorter delay between revocation of privilege and loss

of service• Reduced overhead to deploy & maintain services• Better audit and accountability• Lower profile of credentials (less risk of compromise)

01-Feb-02 12

Divergences from the ideal that will cost you

• Unconnected systems• Back on their own for population & access

management

• Unconnected populations• Invisible to the middleware and integrated

applications

• Isolated attributes• Not available for access control decisions or other

purposes

01-Feb-02 13

Policy matters

• You won’t get data into or out of the enterprise directory without navigating some tricky policy waters

• No adequate standards for vendors to implement for access control over directory content

• So we must fall back on sharing best practices

01-Feb-02 14

A dip into directory internals—the LDAP Recipe

“A Recipe for Configuring and Operating LDAP Directories”

• Michael Gettes, Georgetown University

• Directory Information Tree, Schema,Bindings…

• LDAP filter configuration for white pages

• …and much more

01-Feb-02 15

A dip into directory internals—the Directory Information Tree

dc=edu

dc=wisc

ou=people ou=groups

uid = foocn = Mike SmithgivenName = Michaelsurname = Smith

cn = Letters & Science History Dept{member: uid=foo, ou=people, dc=wisc, dc=edumember:……}

01-Feb-02 16

A dip into directory internals—Schema

• eduObjects: People, Organizations, Services, Resources,…

• Widely implemented common attributes

• Extensible object classes (your attr.here)

• Lower impedance in application access to info

• No need to invest in your own wheel factory

01-Feb-02 17


• eduPerson 1.0• Agreement on higher education community use of

commonly provided attributes• From the person object class: sn (surname):

“If the person has a multi-part surname (whether hyphenated or not), store each component as a separate value in this multi-valued attribute. That yields the best results for the broadest range of clients doing name searches.”

01-Feb-02 18


• eduPerson 1.0• Six attributes newly defined primarily for inter-

institutional uses• eduPersonAffiliation

–faculty, student, staff, alum, member, affiliate, employee

–"member" is intended to include faculty, staff, student, and other persons with a basic set of privileges that go with membership in the university community (e.g., library privileges). It could be glossed as "member in good standing of the university community."

01-Feb-02 19


• eduPerson 1.0• eduPersonPrincipalName (ePPN)

–Of form userid@securitydomain

–For access control lists (.htaccess)

–For shibboleth inter-realm authentication

–Primary requirement: globally unique names

–Sites must publish reassignment rules

01-Feb-02 20


• eduPerson 1.5• Additional attributes needed for Shibboleth and other

access control purposes• eduPersonEntitlement• Simple case: value is the name of a contract for

licensed resource• URIs (URNs or URLs) to allow federation of name

creation without name clashes.–http://xstor.com/contract1234

01-Feb-02 21


• eduPerson 1.5• eduPersonExtension: A playground attribute• URNs to allow federation of name creation without

name clashes.–urn:mace:brown.edu:foo

• [email protected] for information on URN registration

01-Feb-02 22


• eduOrg 1.0 in progress• Basic organizational info attributes from X.520

–Telecomm, postal, locale

• eduOrgBluePage–Multi-valued, labeled URI syntax–Standardized labels for key organizational offices, e.g.:–eduOrgBluePage = http://bussvc.wisc.edu Business Services–eduOrgBluePage = http://dev.washington.edu Development

Office–eduOrgBluePage = http://www.uchicago.edu/sec_pol IT

Security Policies

01-Feb-02 23

Working with applications and with other directories—DoDHE

LocalData Source

CDS

LDAP

GenerateLDIF Data

Submit final LDIF to CDS using authenticated POST via HTTPS.

Filter LDIF according to local policy. Generate

new LDIF for submission.

DODHE

01-Feb-02 24

Working with applications and with other directories—DoDHE CDS

GenerateLDIF Data

dc=edu

dc=georgetown dc=washingtondc=virginiadc=memphis

dn: uid=gettes,ou=People,dc=georgetown,dc=eduobjectclass: {person, organizationalPerson, inetOrgPerson, eduPerson}cn: Michael Gettessn: Gettesmail: [email protected]: Michael R GetteseduPersonPrimaryAffiliation: EmployeeeduPersonAffiliation: Employee

…

01-Feb-02 25

Working with applications and with other directories—DoDConfig Directory

dn: dc=georgetown,dc=eduobjectclass: {organizationalUnit, domain, referral, DoDEntry }cn: Georgetown Universityref: ldap://directory.georgetown.edu/dc=georgetown,dc=edudodRefSearch: ldap://cds1.dodhe.internet2.edu/dc=georgetown,dc=edudodCarnegieClass: Research-1uid: georgetown.edu

dc=edu

dc=georgetown dc=washingtondc=virginiadc=memphis

01-Feb-02 26

Working with applications and with other directories

• Shibboleth Project

• Authenticate locally, access resources globally

• Secure sharing of authorization information between home institution and target site

• Need to front the directory with an Attribute Authority (where policy happens)

• eduOrganization information essential

01-Feb-02 27

Working with applications and with other directories

• Recent NSF Middleware Initiative (NMI) award enabling an expansion of directory work

• Groups in directories (draft just released)

• VidMid Video Conferencing

• Metadirectory practices

• Affiliated directories scenarios

• More on some of these work areas tomorrow

01-Feb-02 28

Conclusion

• The root URL for all these topics:

• http://middleware.internet2.edu

01 February 2002 Directories are Fundamental Keith Hazelton, Senior IT Architect University of...

Documents

Transcript of 01 February 2002 Directories are Fundamental Keith Hazelton, Senior IT Architect University of...