# Presentation: 659137

## NIH Directory Service Overview

- NIH AMG Technical Subcommittee

- DRAFT 2

- 4/17/98

## Outline

- Background
- Guiding Principals
- Requirements
- NIH Person Schema
- Physical Model
- Logical Model
- Next Steps

- DRAFT 2

- 4/17/98

## Background

- AMG Technical Subcommittee formed in August ‘97 to implement NIH Directory Service and Public Key Infrastructure (PKI)
- Main Goals of NIH Directory Service:
- Reliably identify and store information on people who use NIH resources
- Be usable by both people and machines
- Support PKI

- DRAFT 2

- 4/17/98

## Guiding Principals

- Mandate as little as possible
- Maximize use of LDAP & SQL standards
- Assure IC control of IC data
- Link user data using NIH UID as much as possible

- DRAFT 2

- 4/17/98

## Requirements

- Support access via LDAP v2 (v3 future)
- Support access via ANSI SQL and ODBC
- Support an X.500 directory information model
- Provide high availability

- DRAFT 2

- 4/17/98

## Requirements (continued)

- Support secure storage and access to private information
- Provide for hierarchical management

- DRAFT 2

- 4/17/98

## NIH Person Schema

- Based on:
- Lightweight Internet Person Schema
- LDAP v3 User Schema
- Minimal--ICs may add new attributes
- 7 **required** attributes
- All other attributes **optional**

- DRAFT 2

- 4/17/98

## NIH Person Schema Attribute Categories

- Labeling
- Personnel
- General
- Personal (restricted access)
- Mail Address

- Delivery Address
- Physical Address
- Interoffice Address
- Organizational
- Security
- Ancillary

- DRAFT 2

- 4/17/98

## Labeling Attributes (example)

**cn: James Doe ****	****	****	*****required**
**cn: Jim Doe**
**cn: Doe, James**
**cn: Dr James Michael Doe III PhD**
**personalTitle: Dr**
**givenName: James ****	****	****	*****required**
**middleName: Michael**
**sn: Doe ****	****	****	****	*****required**
**generationQualifier: III**
**nihSuffixQualifier: PhD**
**initials: JM**
**uniqueIdentifier: 001-005-8023 ****	*****required**

- DRAFT 2

- 4/17/98

## Personnel Attributes (example)

**o: NIH****	****	****	****	****	*****required**
**ou: CIT****	****	****	****	*****required**
**ou: CFB**
**ou: CIT/CFB**
**ou: CIT/OCRS/CFB**
**ou: CIT/OCRS/CFB/DSS**
**title: Chief, CFB**
**organizationalStatus: government**
**businessCategory: scientist, engineer**

- DRAFT 2

- 4/17/98

## General Attributes (example)

**mail: James_Doe@nih.gov**
**nihUniqueMail: jd15e@nih.gov**
**userCertificate: <binary>**
**labeledURI: http://www.cit.nih.gov Center for**
**	****Information Technology**
**description: NIH government employee**

- DRAFT 2

- 4/17/98

## Personal Attributes (example)Restricted Access

**homePhone: +01 301 123 4567**
**homeFax: +01 301 123 4567**
**personalMobile: +01 301 245 4321**
**personalPager: +01 301 543 4578**
**homePostalAddress: 6453 Sycamore St**
**                   ****Baltimore, MD**
**                   ****29045**
**nihHomeMail: jdoe@erols.com**
**thumbnailPhoto: <binary>**
**jpegPhoto: <binary>**

- DRAFT 2

- 4/17/98

## Mail Address Attributes (example)

**postalAddress: National Institutes of Health**
**               ****9000 Rockville Pike**
**               ****MSC 1234**
**               ****Bethesda, MD**
**               ****20892-1234**
**postalCode: 20892-1234**

- DRAFT 2

- 4/17/98

## Delivery Address Attribute (example)

**nihDeliveryAddress: National Institutes of Health**
**                    ****Building 12A Room 4039**
**                    ****Bethesda, MD**
**                    ****20892-1234**

- DRAFT 2

- 4/17/98

## Physical Address Attributes (example)

**l: Bethesda**
**st: MD**
**c: US****	****	****	****	****	*****required**
**street: 12A South Dr**
**roomNumber: 2025**
**buildingName: 12A**
**houseIdentifier: 12A**
**nihPhysicalAddress: CIT**
**                    ****Building 12A Room 2025**

- DRAFT 2

- 4/17/98

## Interoffice Address Attribute (example)

**dhhsMailstop: 1234**

- DRAFT 2

- 4/17/98

## Organizational Attributes (example)

**telephoneNumber: +01 301 496 1234 ext 25**
**facsimileTelephoneNumber: +01 301 496 1234 $ uncompressed**
**mobileTelephoneNumber: +01 301 496 2345**
**pager: +01 301 496 3456**
**secretary: uniqueIdentifier=0010128162, o=NIH, c=US**
**manager: uniqueIdentifier=0010092979, o=NIH, c=US**
**nihSac: HNU333**

- DRAFT 2

- 4/17/98

## Security Attribute (example)

**userPassword: secret**

- DRAFT 2

- 4/17/98

## Ancillary Attributes (example)

**createTimestamp: 19930214131030**
**modifyTimestamp: 19930214181030**
**creatorsName: uniqueIdentifier=001-006-4639, o=NIH, c=US**
**modifiersName: uniqueIdentifier=001-007-4262, o=NIH, c=US**

- DRAFT 2

- 4/17/98

## Directory Physical Model

- Describes:
- Directory components (applications, servers, databases)
- How components communicate

- DRAFT 2

- 4/17/98

## NIH Directory Service Model

**Users & Services**

- NIH

**ICs Directories**

**NIH Directory**

- LDAP/SQL/ODBC

**IC Information Management**

**NIH Databases**

- Access

- Updates

- DRAFT 2

- 4/17/98

## Directory Service Features

- Centrally operated servers for O=NIH
- ICs use central server **or** provide their own
- Permit **queries** via LDAP and SQL
- Permit **updates** from browser and NOS-specific applications

- DRAFT 2

- 4/17/98

## Directory Service Features (continued)

- Provide for both immediate (e.g add user to directory) and deferred (e.g. HRDB) updates
- Use NIH UID Database to maintain same UID for life of individual
- Provide SQL access via Minimal Schema DB

- DRAFT 2

- 4/17/98

## Directory Service Features (continued)

- Authoritative data source for operational DBs (e.g. parking)
- Compare authoritative (official) DBs (e.g. HRDB) to Minimal Schema DB and generate exception reports

- DRAFT 2

- 4/17/98

## Logical Model

- Describes view seen by directory users
- A.k.a Directory Information Tree (DIT)
- Common designs:
- Functional (People, Services, Groups, etc.)
- Organizational (CIT, OCRS, CFB, DSS)
- Geographical (Bethesda, RTP, Baltimore)

- DRAFT 2

- 4/17/98

## NIH Directory Information Tree (example)

- NIH Directory Information Tree (example)

- DRAFT 2

- 4/17/98

## Next Steps

- Hire directory consultant (2 weeks)
- Establish directory testbed (2 months)
- Complete DIT design
- Select implementation technologyImplement directory prototype
- Specify update service business rules

- DRAFT 2

- 4/17/98

## Directory Physical Model (meta-directory method)

- miscellaneous client interfaces
- (e.g., web browser. NOS specific, etc.)

- minimum
- schema
- database

- DB

- update service
- and rules

- exception
- reports

- non-authoritative
- source
- update

- DB
- (e.g.,
- HRDB)

- query

- authoritative
- source
- compare

- client query
- software

- query

- query

- LDAP
- query

- SQL query

- Users & Services

- Information Sources

- UID GEN

**A**

- IC Services

- join interface

- Creator, Reflector,
- Association

**A**

- (Dir. Native Protocols)

- query*

- query*

- * for eliminating data re-entry

**A**

- DRAFT 2

- 4/17/98