# Presentation: 644917

- <date/time>

- Innosoft International, Inc.
- www.innosoft.com
- sales@innosoft.com

- Trevor Dimond - Senior Consulting Engineer
- (trevor.dimond@innosoft.com)
*Thursday January 27th, 2000*

## Speaker Bio - Trevor Dimond

- Joined Innosoft May, 1999 as a Senior Consulting Engineer
- 15 years at Bank of America, San Francisco (1984-1999) - Senior Systems Engineer, VP
- Designed, deveIoped and deployed Enterprise Wide LDAP directory infrastructure (1998 - 1999)
- Programmer, architect and internal consultant for applications, systems and communications (1984 - 1997)
- 6 years at British Airways, London (1978-1984)
- Applications programmer

## Who is Innosoft?

- Enterprise messaging and directory infrastructure products and services — solutions for heterogeneity now and “whatever” in the future
- High growth with _**focus**_
- Commitment to standards-based computing — _**leadership**_ on MIME, LDAP, ACAP, NOTARY, MIXER, ....
- Stability and continuity of leadership and team — no one leaves
- Heavy duty expertise in enterprise messaging and directory infrastructure solutions — 11+ years in the trenches
- Worldwide customer base
- 2,500+ installed sites
- 52 countries
- 11 international distributors
- balanced mix includes both end user and OEM customers

## History of iii

- Founded September 1987
- Privately funded — no conflicting agendas
- Rapid growth — 39% CAGR for period 1991-1998
- Shipped world’s first commercial **MIME** implementation in May 1992
- DEC worldwide resale agreement in November 1995
- Sun Microsystems licenses PMDF for SIMS in February 1997
- Critical Angle acquired March 1998 — **LDAPv3** technology leader
- Two engineering centers — West Covina, CA and Austin, TX
- Strong technology base — 30 of 45 team members dedicated to engineering and support

## Innosoft International, Inc. Awards

**   ****Network World**** **
**         *****1998 Blue Ribbon Award***

**   ****PC Magazine**** **
**         *****1998 Technical Excellence Awards***

**   ****Data Communications**** **
**         *****1998 Hot Products Award***

**   ****Deloitte & Touche**** **
**         *****1998 Los Angeles Technology Fast 50***

**   ****Network Computing**** **
**         *****1997 Well-Connecting Awards***

**   ****Digital News & Review**** **
**         *****1994-95 Target Award: E-Mail Software***

**   ****Inc. Magazine**** **
**         *****1994-95 500 Fastest-Growing Private Companies***

- Inc.
- 500

## Subjects of particular interest
Interoperability with major players (e.g. Exchange/Active-Directory, Netscape, Siemens, Lotus, etc.)
PKI readiness/interoperability
"Meta-directory”
How DirectoryPortalTM fits in to industry standards activity, including DSML

- Subjects of particular interest
- Interoperability with major players (e.g. Exchange/Active-Directory, Netscape, Siemens, Lotus, etc.)
- PKI readiness/interoperability
- "Meta-directory”
- How DirectoryPortalTM fits in to industry standards activity, including DSML

## Order of Events!
PowerDirectoryTM Technology Presentation
	(key distinguishing features) 
LDAPterTM Technology Presentation
DirectoryPortalTM Technology Presentation
LDAPterTM Demo
DirectoryPortalTM Demo

Questions?
Anytime

- Order of Events!
- PowerDirectoryTM Technology Presentation
- 	(key distinguishing features)
- LDAPterTM Technology Presentation
- DirectoryPortalTM Technology Presentation
- LDAPterTM Demo
- DirectoryPortalTM Demo
- Questions?
- Anytime

## Enterprise Directory Servicesusing LDAP

**Innosoft PowerDirectory**TM

## Innosoft PowerDirectoryTM Features

- Very high performance and database scalability
- over **2000 queries/sec** (Solaris 7, 4x360MHz UltraSPARC-II, 2GB)
- over **700 modifies/sec **(Solaris 7, 4x360MHz UltraSPARC-II, 2GB)
- over **260 add & deletes/sec **(Solaris 7, 4x360MHz UltraSPARC-II, 2GB)
- supports **millions** of entries (recently benchmarked 54 million entries)
- supports multiple backend databases
- performance benchmark white paper available under NDA
- Fully **extensible** and **flexible** schema
- Rich **access control** model
- access controls in directory for PowerDirectory v5.0
- Unique secure LDAP **chaining** for real-time integration with other LDAP directories

## Innosoft PowerDirectoryTM Features

-  Client access and server **chaining** over TLS/SSL
-  Advanced **replication **services - 3 replication models
-  master/slave
-  fallback multi-master
-  secondary shadowing
-  CIM & DEN support (latest draft of CIM schema)
-  Search triggers
-  Virtual attributes
-  Stored transforms (a.k.a. stored procedures)

## Innosoft PowerDirectoryTMInteroperability

- Innosoft PowerDirectoryTMInteroperability

- PKI-ready providing full support for X.509 v3 certificates and certificate revocation lists (CRL’s)
- Certified Entrust Directory Partner
- Valicert CRL product partner
- Checkpoint Firewall-1 and VPN-1 certified

## PowerDirectoryTM Server Transparent ‘Chaining’

**Directory**
**Clients**
**(web, mail, etc.)**

**Innosoft**
**PowerDirectoryTM**
**Server **

**Directory**
**Manager**

**LDAP**

**LDAP/SNMP/HTTP**

**Dynamic LDAP**
** ****Chaining**

**Other**
**LDAP **
**Servers**

**Exchange Dir**

**Netscape Dir**

**Novell Dir**

## Innosoft PowerDirectoryTMIntegrated Replication

-  Available in PowerDirectory**TM** v5.0
-  Uses LDAPv3
-  weakly consistent replication
-  reduced bandwidth demands
-  3 types Integrated Replication:
- master-slave, fallback multi-master, secondary shadowing
-  Primary and Fallback master servers
-  masters coordinate to remain consistent
-  Multiple slaves for scalability & fast response
-  secondary slaves to support replication hierarchies

## Innosoft PowerDirectoryTMFallback Multi-Master Replication

***Primary Master***

***Fallback Master***

***Replicated Slaves***

***Secondary Slave***

***Updates***

***Updates***

***Incremental***
***Update***
***Propagation***

***Updates***

***LDAP***
***Chaining***

***synchronization***

***LDAP***
***Referral***

## Enterprise Directory Servicesusing LDAP Technology

- Enterprise Directory Servicesusing LDAP Technology

**Innosoft LDAPterTM Technology**

## LDAPterTM Technology

- Plugs into existing directories & enhances functionality
- 5 distinct functions:
**Proxy LDAPterTM**** ****	****	**= Client-Server Proxy and Compatibility
**Security LDAPterTM**** ****	****	**= Firewall-like Security
**High Availability LDAPterTM****	**= 24 x 7 Services
- (above LDAPter**TM’**s are packaged together but licensed separately)
**X.500 LDAPterTM**** ****	****	**= X.500-LDAP Compatibility
**Utility LDAPter****TM****	****	**= Extensible Management

## LDAPterTM Technology

- 2 LDAPterTM add-ons
**LDAPterTM RSA module**
- 	Provides RSA encryption algorithms for SSL compatibility and can be used with PowerDirectoryTM Server, Security LDAPterTM and Utility LDAPterTM.
**LDAPterTM SDK**
- 	Provides a** **C API, Java LDAP class library and command line tools to query, add, delete and modify entries via LDAP.

## Proxy LDAPterTM

- Client-Server Proxy
- Controls forwarding of client LDAP operations
-  search, compare, add, delete, modify, modrdn, extended
- Controls attributes permitted/forbidden in search and compare filters
- Recognizes and acts on directory server referrals
-  forward, follow, discard
- Controls number of result entries returned to client
- Controls the search scope

## Proxy LDAPterTM

- Enhancing Compatibility
- Provides client-server schema mapping
- Maps attributes between clients and server
- Allows a single, standard LDAP directory schema  to support multiple different LDAP clients
-  e.g. department **-> **ou **->** department

## Security LDAPterTM

- Protecting Connections
-  number of simultaneous client operations
-  number of operations a client can request per connection
-  restricts the number of connections for a client group
-  times out inactive clients
- Prevents “denial of service” attacks
-  slows down operations forwarded to directory server
-  attacker may think attack is working!

## Security LDAPterTM

- Protecting *Data** *
- Controls data access by hiding data
-  attribute level (permitted/forbidden)
-  entry level
-  sub-tree level
- Provides TLS/SSL support
-  between the LDAP client and the Security LDAPterTM
-  between the Security LDAPterTM and the Directory Server

## Directories = mission critical
 users get used to accessing data 24x7
 critical applications require 100% availability
e.g., Corporate White Pages, PKI infrastructure
Two Services:
 Automatic Failover & Failback
 Automatic Load Balancing
Between multiple LDAP compliant directories

-  users get used to accessing data 24x7
-  critical applications require 100% availability
- e.g., Corporate White Pages, PKI infrastructure
- Two Services:
-  Automatic Failover & Failback
-  Automatic Load Balancing
*Between multiple LDAP compliant directories*

- High Availability LDAPterTM

## High Availability LDAPterTM

- High Availability LDAPterTM monitors directory servers for load and balances operations across masters or slaves in a server group

- Load Balancing

## High Availability LDAPterTM

***Masters or Slaves***

- High Availability LDAPterTM monitors directory servers and detects server failure and redirects operations until recovery

- Transparent Failover

## High Availability LDAPterTM- No Single Point of Failure 

- Three ways to ensure that the HA LDAPterTM server itself is always available
-  High availability hardware - *more expensive option?*
-  Multiple HA LDAPterTM servers *- less expensive option?*
- Use Dynamic DNS
- Use Cisco Local Director

## LDAPterTM Technology -What’s Coming

- LDAPterTM Technology -What’s Coming

- LDAPterTM version 2.1
- Currently in beta testing, target shipping date is end of 1Q2000
- New features
- Attribute-value pair matching, Improved logging, access controls by DN, auto restart, selective TLS/SSL between LDAPter and Directory, bug fixes
- LDAPterTM version 2.5
- Target for beta test is 1Q2000, target shipping date is 2Q2000
- New features
- Configuration GUI built with DirectoryPortalTM technology, log file rotation, dynamic reconfiguration on NT, bug fixes

## X.500 LDAPterTM

- Leverages investment in X.500
- X.500 servers inter-operate with LDAP servers
- Enables X.500-based DUAs and DSAs to perform operations on an LDAP server

## Utility LDAPterTM

- LDAP directory client
- Provides data managers and experienced users with a command line interface to the directory.
- Allows user to manage directories by:
- navigating around
- viewing and modifying entries
- writing and executing scripts
- In V2.0 (commercially available 1Q2000)
- relocate subtrees
- server side relocate - most efficient
- client side copy, add, delete over protocol - least efficient (for servers that don’t support the relocate operation)

## Innosoft DirectoryPortalTM

- Enhancing Enterprise Directory Services with XML-based LDAP access

## DirectoryPortalTMGet More Value From Your Directory

- Directories are increasingly a rich information asset
-  users require new and various directory-enabled apps
-  no single vendor will implement all the apps you need
- Provide richer directory access from the desktop
-  preferably via web browsers
-  allow for evolution and easier data integration
-  allow for easy customization and re-branding of apps
-  define your own directory schema and look-n-feel
-  by your web administrators, not LDAP protocol programmers

## DirectoryPortalTM Rich Information Access

- Most organizations have multiple directories and require tools:
-  to synchronize information
-  to allow dynamic information integration
-  that are easily customized
-  based on industry standards
- There is high value in directory information
-  address books are useful, but also very limited
-  different views for various users and applications
- lots of directory-enabled apps are required

##    DirectoryPortalTM  Technology

- Deliver richer information to the desktop
- Web-accessible
- Based on standard XML technology
- Application Builder & Run-time Java Server
- White Pages Application (DirectoryPortalTM Browser)

## DirectoryPortalTM Why XML and LDAP?

- XML provides a unifying framework
-  Specify XML ‘templates’ to be filled in dynamically
-  Access content from multiple sources
- LDAP tags specify access and update actions
- SMTP tags to allow e-mail triggered by business rules and directory content
- WAP/WML prototype available today
- SQL tags (coming in next release)
-  Present unified information on the desktop
- XML template evaluated by Java server
- content obtained dynamically from directory(s)
- dynamic joins, sorting, etc.
- dynamic HTML generation

## DirectoryPortalTMIntegrating XML with LDAP

- Framework using XML templates and Java server
-  very high-level LDAP “programming” for web authors
-  middleware server engine collects dynamic content
-  HTML generated on-the-fly
**XTL** - eXtensible Template Language
-  an XML application providing LDAP specific tags
- <ldap:search ... >
- <ldap:add ... >
- <ldap:schema ...>, etc.

## DirectoryPortalTM Builder

- Used to develop applications
-  XTL template language
-  Use XML Web authoring tool
- e.g. Dreamweaver, Fireworks (Macromedia)
-  XTL pre-processor - for server compatibility
-  Test environment
-  Available for any Java 1.1+ platform
-  Solaris, NT, Linux, etc.

## DirectoryPortalTM Server

- Executes production applications
-  translates pre-processed XTL applications
-  talks standard LDAPv3 to any LDAP compliant directory servers
-  can run standalone or uses popular web servers
-  run-time monitoring, dynamic property editor included

## Enterprise DirectoryPortalTM Browser

- Customizable corporate directory application
-  works with any LDAPv3 capable directory server
- e.g., Innosoft, Microsoft, Netscape, Novell

## Enterprise DirectoryPortalTM Browser

- Enterprise DirectoryPortalTM Browser includes the following:
-  DirectoryPortalTM Builder license
-  one DirectoryPortalTM application server license
-  corporate directory browser XTL source code

## DirectoryPortalTM Architecture

**DirectoryPortalTM Server**

**Web Users**

**LDAP enabled**
** ****Directory Server(s)**

**Application-specific**
**Template Files w/LDAP tags**

**URLs**

**HTML**

**LDAP requests**

**LDAP results**

- Server engine “executes” XTL templates,  invoking
- LDAP tags to issue LDAP requests and dynamically
- generates standard HTML/WML back to the browser
- based on the formatting described by XML markup

**Phone Users**

**URLs**

**WML**

## DirectoryPortalTM -What’s Coming?

- Version 2.0 of DirectoryPortalTM(1Q2000) will focus on support for applications using WML, DEN and DSML and will include:
- LDAP Directory based property sheets that simplifies management of multiple servlets for load-balancing and availability
- Support for SQL access and update to extend the DirectoryPortal to applications requiring translation of directory content to and from RDBMs
- Multi-part HTTP requests for binary file upload to support applications that allow users to upload images, audio, or other binary objects that are to be stored in a directory. Especially useful in applications that permit the user to upload photos, audio clips, or certificates for transfer to a directory entry
- DSML support

## DirectoryPortalTM -What’s Coming?

- DSML - LDIF with angled brackets?
- The DSML.org has developed a specification for a Directory Services Markup Language (DSML)
- DSML is an XML application that performs a function analogous with the LDAP Interchange Format (LDIF), it uses XML rather than the LDIF line-oriented syntax to represent LDAP directory content
- DSML is compatible with XTL
- DirectoryPortalTM may be used to generate and process DSML content from external resources

## Summary

- Innosoft continues to lead and innovate in LDAP
- LDAP products solve real world integration issues
- Innosoft product suite offers a lot of useful technology
-  high performance and scalable LDAPv3 server
-  LDAPterTM for additional security, load balancing & failover
-  XML/Java LDAP DirectoryPortalTM for web integration
- Innosoft tries to solve customer problems - it doesn’t just sell technology!

## Questions

**?**

## LDAPterTM TechnologyDEMO

- Intranet
- Search for “re”
- Gigi Reddick with mobile number and correct dept info
- Rebecca Barnhart - left the company?
- Rex the dog!
- Extranet
- Search for “re”
- Gigi with no mobile and dept = manager (attribute mapping)
- No Rebecca (DN) and no Rex (subtree)

## DirectoryPortalTM Demo

**DirectoryPortalTMServer**

**LDAP **
**Directory**
**Server(s)**

**WAP**
**(includes URL)**

**LDAP**
**requests**

**LDAP**
**results**

**Encoded**
**WML**

**Wireless**
**Phone**
**Users**
**(simulated)**

**UP.Link**
**WAP Server**

**HTTP**

**WML**