# Presentation: 877153

## Enterprise Information Service (EIS)Directory and Security ServiceLDAP to Kerberos Authentication Critical Design ReviewMarch 6, 2002EIS Directory Service Group

- Directory/Security Service

- 2002-03-06

## Relevant URLs

- This presentation in AFS
- http://eis/dir/dev/library/meta/presentations/cdr/kerberos-cdr.ppt
- Directory Service DocCenter
- http://eis/dir/dev/doccenter/docs/meta
- Security Service DocCenter
- http://eis/sec/dev/doccenter/docs/sec

- Directory/Security Service

- 2002-03-06

## LDAP to Kerberos CDR Agenda

- Specifications Document
- Requirements
- Governing Standards
- Architecture
- Design
- Customer Web Pages (preliminary)
- Operations Procedures (preliminary)
- Test Plan (preliminary)
- Issues
- Transition Plan
- What’s Next

- Directory/Security Service

- 2002-03-06

## LDAP to Kerberos CDR Requirements

**6.2.6  **The Security service shall evaluate authentication decision requests consisting of a principal identifier and password, returning a success value if the hash of the provided password matches the hash stored for the given principal.
**6.2.9***** ***The Security service shall provide information required for audits by the JPL Information Technology Security Official.
* *
**6.2.10***** ***The Security Service shall be engineered, deployed, and staffed for high-availability operation (0.995 availability, excluding scheduled downtime for maintenance).
* *
**6.2.11***** ***The Security Service shall be able to process a minimum of 100 authentication requests and 100 authorization requests per second.

- Directory/Security Service

- 2002-03-06

## LDAP to Kerberos CDR Governing Standards

- Lightweight Directory Access Protocol v3 (LDAPv3)
- RFCs 2251-2256
- Kerberos v4
- ftp://athena-dist.mit.edu/pub/kerberos/doc/techplan.txt

- Directory/Security Service

- 2002-03-06

## LDAP to Kerberos CDR Architecture

- Directory/Security Service

- 2002-03-06

## LDAP to Kerberos CDR Design

- Directory/Security Service

- 2002-03-06

## LDAP to Kerberos CDR – Design: Software

- Directory Server
- iPlanet Directory Server 5.1 (3/15/2002)
- Authentication plug-in

- Directory/Security Service

- 2002-03-06

## LDAP to Kerberos CDRDesign and Facilities

- Directory/Security Service

- 2002-03-06

## LDAP to Kerberos CDR Current JPL Password User Cutover

- Notify users before cut over to synchronize their AFS password with their JPL password.
- Install plug-in on JPL Directory for LDAP to Kerberos authentication
- Modify/remove appropriate web pages
- Once plugin is installed, delete “userpassword” attribute for all entries in the Personnel and Inactive branches to force users to use their AFS password
- Provide careful verbage on afs change password page
- Hand hold customers to switch passwords

- Directory/Security Service

- 2002-03-06

## LDAP to Kerberos CDR Requirements Matrix

- Directory/Security Service

- 2002-03-06

## Lookup Services CDR Monitoring and Metrics

- Continue to use the existing monitors on JPL Directory and FIL service.

- Directory/Security Service

- 2002-03-06

## Lookup Services CDR Customer Web Pages

- Changes
- DIR, “Get JPL Password”, deleted
- DIR, “Change JPL Password”, point ot FIL page
- FIL , “Change AFS Password”, rename AFS password to JPL password
- Various web pages and authentication forms that reference usernames and passwords

- Directory/Security Service

- 2002-03-06

## Lookup Services CDR Operations Procedures

-  4.8.6.23 AFS Authentication Plugin Installation
- Installation of AFS Authentication Plugin for kerberos authentication
-  4.8.6.25 LDAP Password Cutover
- Delete userpassword attribute from entries in Personnel and inactive branches, to force kerberos authentication

- Directory/Security Service

- 2002-03-06

## LDAP to Kerberos CDR – Test Plan

- Directory/Security Service

- 2002-03-06

## LDAP to Kerberos CDR -- Issues

- Currently only getting Ticket Granting Ticket (TGT)
- plan to get service ticket later
- Existing Kerberos implementation does not enforce 7155 rules
- Working with FIL team to implement enforcement functionality
- 3 Phase Implementation
- Phase 1, install Kerberos plugin
- Phase 2, enforce strong passwords on Kerberos server
- Phase 3, enforce 6 month password lifetime on Kerberos server

- Directory/Security Service

- 2002-03-06

## LDAP and Kerberos CDR What’s Next

- Continue working with the Planning and Liaison Office on User notification and education
- Hold DLR March 18, 2002
- Deploy March 29, 2002

- Directory/Security Service

- 2002-03-06