1 Introduction to Directory Services
1.1 What is a Directory?
A directory is a hierarchically organized collection of entries with similar attributes. Directories list resources—for example, people, books in a library, or merchandise in a department store—and give details about each one. A directory can be either offline—for example, a telephone book or a department store catalog—or online.
Online directories are used by enterprises with distributed computer systems for fast searches, management of users and security, and integration of multiple applications and services. Online directories have become critical to e-businesses and hosted environments.
1.2 Understanding Directory and its Role
You can understand about the types of directories and its role from this section.
This section contains the following topics:
1.2.1 The Expanding Role of Online Directories
An online directory is a specialized database that stores and retrieves collections of information about objects. Such information can represent any resources that require management: employee names, titles, and security credentials; information about partners; or information about shared network resources such as conference rooms and printers.
Online directories can be used by a variety of users and applications, and for a variety of purposes, including:
-
An employee searching for corporate white page information, and, through a mail client, looking up e-mail addresses
-
An application, such as a message transport agent, locating a user's mail server
-
A database application identifying role information for a user
Although an online directory is a database—that is, a structured collection of data—it is not a relational database. The following table contrasts online directories with relational databases.
Table 1-1 Comparison of Online Directories and Relational Databases
Online Directories | Relational Databases |
---|---|
Designed to handle relatively simple transactions on relatively small units of data. For example, an application might use a directory simply to store and retrieve an e-mail address, a telephone number, or a digital portrait. |
Designed to handle large and diverse transactions using many operations on large units of data. |
Designed to be location-independent. Directory-enabled applications expect, at all times, to see the same information throughout the deployment environment—regardless of which server they are querying. If a queried server does not store the information locally, then it must either retrieve the information or point the client application to it transparently. |
Typically designed to be location-specific. While a relational database can be distributed, it usually resides on a particular database server. |
Designed to store information in entries. These entries might represent any resource customers want to manage: employees, e-commerce partners, conference rooms, or shared network resources such as printers. Associated with each entry are several attributes, each of which may have one or more values assigned. For example, typical attributes for a |
Designed to store information as rows in relational tables. |
1.2.2 The Problem: Too Many Special-Purpose Directories
In the past, some large companies had more than a hundred different directories, each designated for a special purpose. In addition, some applications had their own additional directories of user names.
Managing so many special purpose directories caused several problems, including:
-
High cost of administration: Administrators had to maintain essentially the same information in many different places. For example, when an enterprise hired a new employee, administrators created a new user identity on the network, created a new e-mail account, added the user to the human-resources database, and set up all applications that the employee might need—for example, user accounts on development, testing, and production database systems. Later, if the employee left the company, administrators had to reverse the process to disable all these user accounts.
-
Inconsistent data: Because of the large administrative overhead, it was difficult for multiple administrators, entering redundant information in multiple systems, to synchronize this employee information across all systems. The result was inconsistent data across the enterprise.
-
Security issues: Each separate directory had its own password policy—which means that a user had to learn a variety of user names and passwords, each for a different system.
Today's enterprises need a more general purpose directory infrastructure, one based on a common standard for supporting a wide variety of applications and services.
1.3 What is Lightweight Directory Access Protocol (LDAP)?
The topics in this section introduce you to LDAP, a standard, extensible directory access protocol that directory clients and servers use to communicate.
1.3.1 LDAP and Simplified Directory Management
LDAP was conceived as an Internet-ready, lightweight implementation of the International Standardization Organization (ISO) X.500 standard for directory services. It requires a minimal amount of networking software on the client side, which makes it particularly attractive for Internet-based, thin client applications.
The LDAP standard simplifies management of directory information in three ways:
-
It provides all users and applications in the enterprise with a single, well-defined, standard interface to a single, extensible directory service. This makes it easier to rapidly develop and deploy directory-enabled applications.
-
It reduces the need to enter and coordinate redundant information in multiple services scattered across the enterprise.
-
Its well-defined protocol and array of programmatic interfaces make it more practical to deploy Internet-ready applications that leverage the directory.
1.3.2 LDAP Version 3
The most recent version of LDAP, Version 3, was approved as a proposed Internet Standard by the Internet Engineering Task Force (IETF) in December 1997.
LDAP Version 3 improves on LDAP Version 2 in several important areas:
-
Globalization Support: LDAP Version 3 allows servers and clients to support characters used in every language in the world.
-
Knowledge references (also called referrals): LDAP Version 3 implements a referral mechanism that allows servers to return references to other servers as a result of a directory query. This makes it possible to distribute directories globally by partitioning a directory information tree (DIT) across multiple LDAP servers.
-
Security: LDAP Version 3 adds a standard mechanism for supporting Simple Authentication and Security Layer (SASL), providing a comprehensive and extensible framework for data security.
-
Extensibility: LDAP Version 3 enables vendors to extend existing LDAP operations by using mechanisms called controls. These are extra pieces of information carried along with existing operations, altering the behavior of the operation. When a client application passes a control along with the standard LDAP command, the behavior of the commanded operation is altered accordingly. For example, when a client wants to modify meta-information hidden in the directory, it can send the manageDSAIT control along with the LDAP command.
-
Feature and schema discovery: LDAP Version 3 enables publishing information useful to other LDAP servers and clients, such as the supported LDAP protocols and a description of the directory schema.
See Also:
-
RFCs (Requests for Comments) 2251-2256 of the IETF, available at:
http://www.ietf.org
-
Related Documents for an additional list of resources on LDAP
-
Understanding the Concepts and Architecture of Oracle Internet Directory for a conceptual discussion of directory information trees and knowledge references
-
About LDAP Controls in Reference for Oracle Identity Management for a list and description of controls supported by Oracle Internet Directory
-
1.4 Understanding Oracle Internet Directory
You can understand about the overview, components and advantages of Oracle Internet Directory in the following sections.
1.4.1 Overview of Oracle Internet Directory
Oracle Internet Directory is a general purpose directory service that enables fast retrieval and centralized management of information about dispersed users and network resources. It combines Lightweight Directory Access Protocol (LDAP) Version 3 with the high performance, scalability, robustness, and availability of an Oracle Database.
Oracle Internet Directory runs as an application on an Oracle Database. It communicates with the database by using Oracle Net Services, Oracle's operating system-independent database connectivity solution. The database may or may not be on the same host. Figure 1-1 illustrates this relationship.
Figure 1-1 Oracle Internet Directory Overview
Description of "Figure 1-1 Oracle Internet Directory Overview"
1.4.2 Components of Oracle Internet Directory
You can understand about the components of Oracle Internet Directory in the following section.
Oracle Internet Directory includes:
-
Oracle directory server, which responds to client requests for information about people and resources, and to updates of that information, by using a multitiered architecture directly over TCP/IP
-
Oracle directory replication server, which replicates LDAP data between Oracle directory servers
-
Directory administration tools, which include:
-
The Oracle Internet Directory pages in Oracle Enterprise Manager Fusion Middleware Control
-
Oracle Directory Services Manager
-
Command-line administration and data management tools
-
-
Oracle Internet Directory Software Developer's Kit
See Also:
Developing Applications for Oracle Identity Management in Application Developer's Guide for Oracle Identity Management in the Oracle Internet Directory Software Developer's Kit
1.4.3 Advantages of Oracle Internet Directory
Among its significant benefits, Oracle Internet Directory provides scalability, high availability, security, and tight integration with the Oracle environment.
1.4.3.1 Scalability in Oracle Internet Directory
Oracle Internet Directory exploits the strengths of an Oracle Database, enabling support for terabytes of directory information. In addition, such technologies as shared LDAP servers and database connection pooling enable it to support thousands of concurrent clients with subsecond search response times.
Oracle Internet Directory has a multi-threaded, multi-process and multi-instance physical architecture. This brings great flexibility to deployment options. Oracle Internet Directory can scale with a very high number of CPUs on SMP or NUMA hardware. With Oracle RAC database and the Oracle Internet Directory cluster configuration, you can deploy a single directory on multiple hardware nodes for horizontal scalability.
Oracle Internet Directory also provides data management tools, such as Oracle Directory Services Manager and a variety of command-line tools, for manipulating large volumes of LDAP data.
See Also:
High Availability Concepts in Oracle Fusion Middleware High Availability Guide
1.4.3.2 High Availability in Oracle Internet Directory
Oracle Internet Directory offers the most comprehensive high availability configurations. Directory replication, active/passive cluster configuration, active/active cluster configuration with Oracle RAC Database, and Disaster Recovery configurations with Oracle Data Guard.
Oracle Internet Directory also takes advantage of all the availability features of the Oracle Database. Because directory information is stored securely in the Oracle Database, it is protected by Oracle's backup capabilities. Additionally, the Oracle Database, running with large data stores and heavy loads, can recover from system failures quickly.
See Also:
High Availability Concepts in Oracle Fusion Middleware High Availability Guide
1.4.3.3 Security Benefits in Oracle Internet Directory
Oracle Internet Directory offers comprehensive and flexible access control. An administrator can grant or restrict access to a specific directory object or to an entire directory subtree. Moreover, Oracle Internet Directory implements three levels of user authentication: anonymous, password-based, and certificate-based using Secure Sockets Layer (SSL) Version 3 for authenticated access and data privacy.
With Oracle Database Vault, Oracle Internet Directory can restrict administrators and privileged users from accessing Directory data. With Oracle Transparent Data Encryption, Oracle Internet Directory can ensure protection of data on disk as well as on backups.
1.4.3.4 Integration of Oracle Internet Directory with Oracle Environment
Through Oracle Directory Integration Platform, Oracle Internet Directory provides a single point of integration between the Oracle environment and other directories such as NOS directories, third-party enterprise directories, and application-specific user repositories.
1.5 How Oracle Products Use Oracle Internet Directory
Oracle products use Oracle Internet Directory for easier administration, tighter security, and simpler integration between multiple directories.
1.5.1 Easier and More Cost-Effective Administration of Oracle Products
Various Oracle products use Oracle Internet Directory. Some of them are described in the following section.
Oracle Platform Security Services stores users and groups in an embedded LDAP repository by default. Domains can be configured, however, to use identity data in LDAP repositories, such as Oracle Internet Directory. In addition, Oracle WebLogic Server provides a generic LDAP authenticator that can be used with other LDAP servers. By default, OPSS stores policies and credentials in file-based stores. These stores can be changed (or reassociated) to an LDAP repository backed by an Oracle Internet Directory or an Oracle Virtual Directory server.
Oracle Webcenter Suite bases its security on OPSS. It can delegate enforcement to Oracle Internet Directory for identity, policy, and credential storage. You can use LDAP commands to add or modify users and to search the directory, which can be useful when exporting and importing user accounts.
Oracle Access Manager supports storing user, configuration, and policy data in directories, such as Oracle Internet Directory (multiple realms). You can store data either together on the same directory server or on different directory servers.
Oracle Net Services uses Oracle Internet Directory to store and resolve database services and the simple names, called net service names, that can be used to represent them.
1.5.2 Tighter Security Through Centralized Security Policy Administration in Oracle Internet Directory
The Oracle Database uses Oracle Internet Directory to store user names and passwords, along with authorization information such as enterprise roles. It uses Oracle Internet Directory to store a password verifier along with the entry of each user.
Oracle Enterprise User Security uses Oracle Internet Directory for:
-
Central Management of user authentication credentials
Instead of storing a user's database password in each database, Oracle Advanced Security stores it in one place: the directory. It stores the password as an attribute of the user entry.
-
Central management of user authorizations
Oracle Advanced Security uses directory entries, called enterprise roles, to determine the privileges for a given enterprise user within a given schema, whether that schema is shared or owned. Enterprise roles are containers for database-specific global roles. For example, a user might be assigned the enterprise role of clerk, which might contain the global role of hr clerk with its attendant privileges on the human resources database and the global role of analyst with its attendant privileges on the payroll database.
-
Mappings to shared schemas
Oracle Advanced Security uses mappings—that is, directory entries that point an enterprise user to shared application schemas on the database instead of to an individual account. For example, you might map several enterprise users to the schema
sales_application
instead of to separate accounts in their names. -
Single password authentication
In the Oracle Database, Oracle Advanced Security enables enterprise users to authenticate to multiple databases by using a single, centrally managed password. The password is stored in the directory as an attribute of the user's entry and is protected by encryption and access control lists. This spares you from setting up Secure Sockets Layer (SSL) on clients and users from having to remember multiple passwords.
-
Central storage of PKI credentials
In Oracle Database and Oracle Application Server, user wallets can be stored in the directory as an attribute of the user's entry. Storing wallets in this manner enables mobile users to retrieve and open their wallets by using Enterprise Login Assistant. While the wallet is open, authentication is transparent—that is, users can access any database on which they own or share a schema without having to authenticate again.
1.5.3 Integration of Multiple Directories with Oracle Internet Directory
Integrating multiple directories with Oracle Internet Directory is described in the following section.
Another directory services product, Oracle Virtual Directory, provides a single, dynamic access point to multiple data sources through LDAP or XML protocols. It does this by providing a real-time data join and an abstraction layer that exposes a single logical directory, without the need to synchronize or move data from its native location. Oracle Virtual Directory can provide multiple application-specific views of identity data stored in, for example, Oracle Internet Directory, Microsoft Active Directory and Sun Java Systems Directory instances, and can also be used to secure data access to the application-specific sources and enhance high-availability to existing data-sources. These capabilities accelerate the deployment of applications and reduce costs by eliminating the need to consolidate user information before an application can be deployed. Oracle Virtual Directory can constantly adapt those applications to a changing identity landscape as user repositories are added, changed, or removed. Oracle Virtual Directory provides the following benefits:
-
Consolidates multiple directories
-
Provides virtualization and distribution of directory services
-
Reduces administrative cost and improves security
-
Extends enterprise applications quickly
-
Provides ubiquitous access to information
-
Lowers cost of implementation
Oracle Directory Integration Platform is a collection of interfaces and services for integrating multiple directories by using Oracle Internet Directory and several associated plug-ins and connectors. It provides these benefits:
-
All Oracle components are pre-certified to work with Oracle Internet Directory.
-
You can integrate the entire Oracle environment with third-party directories simply by integrating each third-party directory with Oracle Internet Directory. This saves you from having to integrate each application with each directory.
See Also:
Concepts and Architecture of Connected Directory Integration in Administering Oracle Directory Integration Platform