Netscape Directory Server Deployment Guide: Directory Deployment Overview

Complete Contents
Introduction
Chapter 1 Welcome to the Directory Server
Chapter 2 Directory Deployment Overview
Chapter 3 Planning Your Directory Data
Chapter 4 Planning Directory Schema
Chapter 5 Planning Security Policies
Chapter 6 Directory Tree Design
Chapter 7 Planning Replication
Chapter 8 Planning Referrals
Chapter 9 Directory Design Examples
Chapter 10 Extending Your Directory Service
Appendix A Quick Start

Contents

Index

Chapter 2 Directory Deployment Overview

This manual provides information and advice on how to design a robust, secure directory service that is both easy to scale and easier still to manage. As part of this design goal, this manual helps you avoid unnecessary complexity in your directory design.

As you go about designing your directory service you should follow the general philosophy that a simple design is a better design. While it is not possible to entirely avoid complexity, you should strive for simplicity in all aspects of your directory design.

In this chapter you will learn about the directory design process. This chapter includes the following sections:

Directory Design Activities Overview—This section briefly describes the various planning activities that you must perform to successfully design and roll-out a directory service.

Deployment Advice—This section provides high-level advice on physically installing your directory service into your production environment.

Directory Design Activities Overview

The most important task to ensuring a successful directory service is planning. As with all software deployments, good planning in the early stages of the deployment will save you time and money as your directory service grows and matures. You should therefore budget plenty of time to plan your directory's contents, directory access-controls, physical placement of Directory Servers, and replication strategies.

However, remember that the Netscape Directory Server is very flexible. It is possible for you to easily rework your directory service after the initial deployment phase to meet unexpected or changing requirements. Therefore, your goals in planning your service should be to anticipate your enterprise's needs as much as possible, but you should not feel that you have to know every single detail in advance.

There are a few major areas to focus on when planning your directory service. Each of these areas have some overlap with other areas, but if you plan for each of these aspects of your directory service, you will have a good understanding of your directory's requirements and design.

Because these areas are heavily interrelated, the order in which you approach them is up to you. However, you may find that it is useful to examine each of these areas in the following order:

Plan your directory contents. This includes determining what data you want to keep in your directory and how you will represent that data in the directory. As a part of this planning, you must also locate the data in your enterprise. It is very likely that you will find that the information that you want to keep in your directory is currently contained in many different locations, and potentially mastered by multiple organizations. You may also find that some of the data you want to keep in your directory is not currently maintained in your enterprise and so processes will have to be developed to maintain this information.

Plan data management. Who will own (add, modify, or delete) each piece of information and who can read it? Also, determine the physical location where the master of each piece of data will be kept.

Plan access-control. This is related to data management. Who can access what data in your directory? Who can read the data? Who can write to the data?

Plan groups. This is also related to access-control and data management. Decide what groups you will maintain in your directory, and what special privileges, if any, will you grant each group.

Plan replication. This entails deciding where you are going to physically place Directory Servers, and which servers will be responsible for mastering which data. It is not required, for example, to place all of your enterprise's data on every server. Instead, you may want to replicate just the information to a server that is of interest to the people or applications near that server.

Plan referrals. This is directly related to replication management. If a server will not contain information of general use to your enterprise, then you may want to create smart referrals to a server that does contain the data.

Plan the directory tree. After you have spent some time examining your enterprise's directory requirements you will be in a much better position to understand what your directory tree will look like. Expect the tree's layout to change multiple times as you come to a better understanding of your enterprise's requirements. Because directory tree design is often fluid in the early stages of directory planning, it is best to sketch the design on paper and not attempt to represent it on an actual Directory Server until the other aspects of your design have been finalized.

Deployment Advice

After you have planned your directory service, you can start to physically install your directory service into your production environment. As is the case with directory design, the most important aspect of your directory deployment is planning. By spending the time to plan the installation and population of your service, you will increase your users' confidence in the directory by avoiding unexpected and embarrassing outages.

To help you keep your deployment problem set to a manageable size, you should use a phased deployment that implements well-defined aspects of your directory service in stages. This will in turn help to reduce the total time and head count needed to deploy your directory service, and thus reduce the total cost of ownership for the directory.

Finally, by using a well-planned, phased deployment strategy, you can locate unexpected problems in your design before they become mission-critical.

Keep this deployment advice in mind:

Start small. Instead of simultaneously installing every Directory Server that will be a part of your directory service, install just a few at first. Populate those few servers with the immediately necessary information and then provide some well-defined group of users access to the service. See how your users actually use the service (what their access habits are like) and how well your network infrastructure responds to the increased network load. Be prepared to add or subtract servers as usage patterns become clear.

Because you are centralizing information, your directory service must be available at all times. By gradually deploying your directory service, you can ensure that the supporting hardware, networks, and software are up to handling the increased loads.

Grow over time. Once you have experience with how your directory service is performing for the initial roll-out, continue to deploy in stages. Do not try to install your entire directory all at once, especially if you are deploying into a large, complex environment. Instead, continue extending the service to other core locations around your enterprise in stages. Do this not only with the installation and configuration of your Directory Servers and clients, but also with the migration of data from legacy directories to the LDAP directory.

Deploy in parallel with existing directories. Give your new directory service some time in your production environment before dismantling your legacy directories and databases (if that is your goal). Start with the LDAP directory running as a secondary or backup service to your existing infrastructure. Once the LDAP directory has proven itself, you can start to use it in the primary role and downgrade your legacy systems to the secondary or backup role. After a sufficient amount of time has passed without any significant problems, you can eliminate your legacy directories altogether, if you so desire.

The amount of time that should pass before you rely entirely on your LDAP directory depends on the state of your computing environment, including the reliability of your networks, the complexity of your data management tasks, and the availability of LDAP-enabled software that allows you to manage information directly in the LDAP directory. You will find that the biggest hurdle to moving to an LDAP-only environment is getting all your mission-critical applications to use LDAP.