Identity and Access Management

Dir Directory V9.0
High-End Directory Server
High-performance, highly available, highly reliable, highly scalable,
and secure LDAP / X.500 Directory Server and LDAP Proxy
Directory services are critical components of today’s highly interconnected business environment,
providing the foundation for identityand access management across theever-widening boundaries of theenterprise. In the intranet environment, the directory service provides a
global repository for shared information about employees, organizations,and resources such as applications,network devices, IoT devices, andother distributed services, accommodating hundreds of thousands ofusers. In the extranet environment,
the directory service maintains profile information about customers,
trading partners, and suppliers, holding millions of users. For both environments, the directory service must
be able to manage user identities
and control access to the informationand services offered to its users, andit must provide fast, always available,authenticated access to the information and services, potentially to ahuge number of users.
DirX Directory meets these requirements, and more. The DirX Directory
service provides a standards-compliant, high-performance, highly
available, highly reliable identity
management platform with near-linear scalability. DirX Directory can act
as the identity store for employees,
customers, trading partners, subscribers, and other e-business entities.
DirX Directory can also serve as a provisioning, access management andmetadirectory repository, to provide
a single point of access to the information within disparate and heterogeneous directories available in anenterprise network or cloud environment for user management andprovisioning.

Standards and compatibility

Identity management

DirX Directory implements the
LDAPv3 and X.500 directory standards. DirX Directory permits thirdparty LDAP-enabled applications tomanage the directory schema over
LDAP. DirX Directory runs on themost popular operating systems
and supports a wide variety of applications via the Lightweight Directory
Access Protocol (LDAP).

As the foundation for an identity
management system, DirX Directory can manage user and subscriber
profiles, digital certificates for public
key infrastructures (PKIs), authorization and authentication information, access permissions and otherrelevant attributes for users andsubscribers that control access to
information, network resources, IoT
devices or other distributed services.

The DirX LDAP proxy is to provide a
central access point for LDAP clients
hiding the actual processing server
knowledge from them as well as
hiding server outages from clientsand providing load balancing transparently to the clients.

High performance
DirX Directory is based on the innovative DBAM database kernel (Directory Basic Access Method) that is
optimized for directory access, allowing sub-second response times andhigh throughput rates for parallel
queries. A high- performance database cache buffering portions of thedirectory data in main memory.

High availability andreliability
To meet reliability requirements forthe directory service, DirX Directory
supports floating master replication
for high availability configurations (asoftware solution instead of adding
hardware clusters) and failover. For
backup and recovery, DirX Directory
supports full and differential saving
in parallel with directory update
operations. Transaction processing in
the database provides guaran- teedrecovery after crashes without data
loss.

Security
DirX Directory supports SSL/TLS
for LDAP server and client authentication, X.500 DAP authentication,authorized user access control,
encrypted communication, andserver-side policies for local security
management. DirX Directory also
permits the creation and enforcement of password policies to control
how passwords are used and administered in an enterprise network.
Policies for password complexity,
aging, and reuse after expiration aresupported. High performance audit
is provided for traffic analysis andaccounting.

Scalability
The DBAM database kernel isdesigned to permit linear scalability
in a single directory server. Benefits:
DirX Directory can accommodate
future growth on existing hardware
configurations, can scale rapidly tostore huge number of users in an
extranet or cloud deployment andcan scale from workgroup to enterprise to e-business directory roles.
Running the DirX Directory LDAP
Server in proxy mode provides a central access point to a directory service
for LDAP clients and extends bothscalability and availability.

restore tool dirxbackup

dard and supports, among others:

Administration

Directory protocols

DirX Directory offers powerful graphical and command-based scriptable
tools for centralized administrationof a distributed directory system,
including auditing, monitoring, andlogging functions.

The following protocols are supported in accordance with the Internet and 1993 X.500 standard:

Access to DirX Directory
The data stored in DirX Directory isaccessible through• Any LDAP client and LDAP-enabled application• A command-line administrationinterface with full LDAP functionality which can also be controlled
via Tcl scripts• DirX Manager, a Java-based management client

DirX Directory components• Directory System Agent (DSA)• LDAP server and LDAP proxy• Java-based, graphical administration interface DirX Manager for
configuration and administrationof local and remote DirX Directory
servers• Command-driven bulk-loading
tools dirxload and dirxmodify• Command-driven directory client
dirxcp for the administration of
entries via LDAP and DAP• Command-driven management
client dirxadm for DSA and LDAP
servers

LDAP: The Lightweight Directory
Access Protocol, the Internet directory standard, is supported efficiently
by an integrated LDAP server.
DAP: The Directory Access Protocol,
which defines the exchange of queries between Directory User Agents(DUA) and Directory System Agents(DSA).
DSP: The Directory System Protocol,
allowing DSAs to forward queries andadministration requests they cannot
answer themselves to other DSAs.
This protocol also handles returning of results to the DSA where thesearch query or request originated.
DISP: The Directory Information
Shadowing Protocol provides fordata replication between DSAs. As
the protocol also regulates copyingof the access control data, collective
attributes, and schema information,
replicated data can be accessed
without loss of information.
IDM: The Internet Directly Mapped(IDM) protocol is a mapping of theX.500 protocols directly onto TCP/IP
and is supported for DAP, DSP, and
DISP.

X.500 information model• Command-driven backup andDirX Directory conforms to the information model of the 1993 X.500 stan-

Information

Security

Knowledge
Management

Partner/Supplier
Customer/Subscriber
Directories

Identity &AccessManagement

Network
Management
DigitalSignature
PKI / X.509
ServiceOriented
Architecture

Billing &Accounting

Firewall /Virtual Private
Networks

Voice over IP
CTI, Call Center

Resource
Management

Portal Solutions/
CRM

User Profiles
UnifiedMessaging

e-Procurement
e-Commerce

e-BusinessEnterprise
Information
Management

User
Privileges

SingleSign-On

Remote AccessWhite/Yellow
Pages

Administration

Mobile Access• Collective attributes - identicalattributes of several directory
entries which are accessed likenormal attributes, but which are
stored once only and managed ata central location• Access control rules for parts of adirectory tree
• Attribute subtyping: the optionof accessing specific attributes
by referencing generic attributes(e.g., PrivateTelephoneNumber asa subtype of TelephoneNumber)• Operational attributes: attributes
used for internal purposes or
which, like the timestamp, are generated by the directory itself.

Directory schema
DirX Directory supports the attribute types and syntax rules definedin X.520.
The attribute types defined in X.509
and the matching rules defined in
X.521 are also supported, as are phonetic rules for finding entries withsimilar values.
Likewise supported are all object
classes defined in X.521 as are all
object classes, attribute types andsyntaxes defined by LDAP RFCs 4512,
4517, 4523 and 2798 (inetOrgPerson).
DirX Directory allows storing X.509
attribute certificates by providing
support for X.509 (2000) attributecertificate syntax.
DirX Directory supports the ACP 133
schema in accordance with the document “Common Directory Services
and Procedures Supplement ACP
133 SUPP-1(A)” by the Combined
Communications Electronics Board(CCEB).
In extension to the X.500 standards and LDAP RFCs, DirX Directory supports dynamic groups andmulti-level nested groups. Various
attributes are provided to support
LDAP applications in identifying andresolving dynamic and nested groupmemberships. DirX Directory allows
using dynamic and nested groups forthe management of access control
and user policies.
The LDAP server supports theattributes of the LDAP root DSE as
defined by RFC3045 and RFC4512.

Communication

DirX Directory supports schema
management over standard LDAPv3
clients like DirX Manager or thebulk-loading tool dirxmodify.

Figure 1 - DirX Directory – Areas of application

It allows both the handling of stan-

2 | DirX Directory V9.0

HTTP

LDAP RPC SNMP

HTTP
ServerLDAP Server

DAP

LDAP

RPC

LDAP
Result Cache

Audit

DAP

MIB

Audit

DSP DISPRPC SNMP
RPC

Configuration
Cache

DSA
ServerMIB

DBAM
Database

Transaction
Manager

Progsvr

Audit

BufferCache

ObjectStore

Transaction
Logs

LDIF

JournalReplication
Events &Trigger

Figure 2 - DirX Directory - Architecture
dardized schema elements and thedefinition and administration of private object classes and attributes.
DirX Directory also allows enforcing
the uniqueness of attribute values
for specific attribute types (e. g., withstring syntaxes) within the directory
server and all its full shadows.

LDAP Server and LDAP Proxy
DirX Directory includes an LDAPv3
server, which provides access fromany LDAP client. The LDAP serveris a full implementation of the core
LDAPv3 protocol.
The LDAP server may be installed
co-located with the DSA or on aremote system.
For load balancing one can connect
more than one LDAP server with a
DSA and one LDAP server can be connected to multiple DSAs if they arefull shadow DSAs. In the latter case,
LDAP clients might benefit from theimplemented failover mechanism as
in most cases the LDAP client operations can still succeed even if one
DSA cannot serve the request.
The LDAP server supports securecommunication over SSL/TLS.
The LDAP server supports a configurable, high-performance result
cache with selective update that iswell-suited for high-performance
applications.
LDAP Proxy
Running the DirX Directory LDAP
server in proxy mode allows routing
incoming LDAPv3 requests from
LDAPv3 clients to any remote target
LDAPv3-compliant directory server
and associates responses back to therequesting client.
The main advantage of an LDAP
proxy is to provide a central accesspoint for LDAP clients hiding theactual processing server knowledge
from them as well as hiding server
outages from clients and providing
load balancing transparently to theclients.
Key features of the DirX Directory
LDAP proxy include:• Rule-based request routing: The
LDAP Proxy selects the target
server based on the evaluation ofa configurable set of rules. Bothuser-routing rules and operation-routing rules are supported.
• Load Balancing: A round-robinmechanism selects the target
server for the next connection
to be routed to, considering theresults of the rule evaluation of therequest routing.
• Failover: If a target server is unavailable due to connection error,
the request fails over to the next
appropriate target server according to configuration settings.
• Rule-based LDAP request andresult rewriting: The rewriting feature includes schema and attributemapping to provide schema compatibility that is helpful for clientsthat use an outdated schema orthat contain a hard-coded schema.
This feature can also be used to
implement an additional access
control layer. One can define what
actions users are allowed to do bydenying certain requests or hidingor blocking critical subtrees, entries
and attributes of search operations
and their results. It also allows protecting the directory infrastructurefrom specific end users.

DBAM Data Management
The data management of DirX Directory builds on the innovative DBAM
database kernel, which offers a highly
efficient basis for virtually unlimited
scalability, optimum access anddirectory tree modelling.

Key advantages of the databaseinclude:• Huge storage capacity• Optimum indexing for fast, efficient search operations• High-performance name resolution and name retrieval• High-performance databasecache for buffering portions of thedirectory data in main memory• High-performance transaction
handling and recovery• Support of LDAP RFC 2696 forhigh- performance paged results
For the management of the DBAM
database, DirX Directory provides
utilities for:• Configuring the DBAM database• Checking the DBAM database• Post-indexing of attributes• Reorganizing the database to provide optimized access• Recovering (saving and restoring)the database

LDIF
DirX Directory supports high-performance export to LDAP Data Interchange Format (LDIF) files. One
can flexibly export the whole DSA
database or parts of it (LDIF content
files) or just changes to the existingdata (LDIF change files). This permits administrators to carry out bulk
data transfers and to integrate DirX
Directory with other directories andspecially to use it as a metadirectory
store. LDIF files provide the interface
to publish directory change events.
Post-processing of LDIF files can betriggered automatically.

Replication
DirX Directory implements the creation and automatic update of direc-

DirX Directory V9.0 | 3

tory replicas (shadows) in order toincrease data availability and accessperformance.
In a replication environment, amaster DSA replicates data to one ormore shadow DSAs. For high-availability, DirX Directory supports thefloating master concept, where ashadow DSA can act as the newmaster DSA if the old master DSA
has a failure.
Each shadow DSA can be set up to
work either in synchronous or asynchronous shadowing mode.
Because it ensures data synchronicity, a synchronous shadow DSA is an
ideal candidate for load distribution
purposes and failover in the floating
master scenario.
A synchronous shadow DSA is also
suitable for LDAP/DAP clients that
perform read operations immediately following successful modify
operations: whenever an LDAP client
reads after a successful modify operation, it receives the right result.
In contrast to synchronous shadowing, which always replicatesthe entire master directory tree,
asynchronous shadowing provides
greater flexibility in defining the replication area according to selected
attributes or the parts of the tree tobe replicated.
DirX Directory DSAs support a
number of shadowing options:• Incremental-refresh and total-refresh operations over DISP• LDAP and DSA servers can be
deployed on different machines
and multiple LDAP servers can beconnected to one DSA server

authentication for LDAP simple
binds using Microsoft Windows or
LDAPv3, e.g., to an IBM RACF LDAP
server.

DSAs communicate over DSP toprovide a seamless view of the distributed directory service to applications.

DirX Directory leverages certificate
revocation lists (CRLs), i.e. a revokedcertificate from a given CRL is nolonger useable for a successful SASL
authentication.

Security
DirX Directory supports the SSL/TLS(Secure Socket Layer 3.0 / Transport
Layer Security 1.0/1.1/1.2/1.3) protocols
creating the basis for authenticated,encrypted communications via theInternet for:
• LDAP servers and LDAP clients• X.500 DAP, DSP and DISP for X.500
DSA-to-DSA and DUA-to-DSA
communication over IDM.
In addition, DirX Directory supports:• Authentication between DUA andDSA by means of the DAP protocol or between servers by meansof server-server protocols,• Access control in order to restrict
access to authorized users and• Server-side policies for local security management.

Authentication
For authentication over LDAP, aseries of security layers can be used,
depending on concrete needs:• Simple bind using name and password• Periodic update and update onchange over DISP

• Simple bind using name and password via an encrypted connection
over SSL/TLS• High-performance bulk replication
based on save and restore of thedatabase for total refresh• SASL authentication with mechanism EXTERNAL (certificate-based
SSL/TLS client authentication)

Distribution• Configurable support of external

DirX Manager provides authentication/login via CardOS smart cards
that are supported by Atos CardOS
API. From the LDAPv3 protocol view,smart card login maps onto an LDAPSASL bind with the mechanism type
EXTERNAL. This means the security
services of the underlying TLS/SSL
layer are used to perform the client
authentication that is based onstrong cryptography.

Access Control
Access to DirX Directory information
is protected in a number of ways andcan be defined down to the level ofindividual attributes in entries. DirX
Directory supports both Basic AccessControl (BAC) and Simplified AccessControl (SAC) including Access Control Information for entries, sub-entries, and attributes.
As an extension to the X.500 model,
both the access control targets, andthe affected users can be defined byarbitrary LDAP filters.
The model of proxied authorization issup- ported according to RFC 4370.
The auditing functionality enables
system security to be monitored anddocumented.

Password Policies
To enhance the directory security,
DirX Directory allows defining andScalability, availability, load distribution and performance tuning are themain reasons to set up a distributed
directory service. DirX Directory supports several options to set up a distributed directory service:

DirX Directory
LDAP Server 1• Distributed directory service basedon shadowing, where one master
DSA holds the complete Directory
Information Tree (DIT) and shadow
DSAs hold replicas of the DIT• A true distributed directory service,where the DIT is split over different
DSAs• A combination of true distribution
and shadowing in which pieces ofa DIT held by two different DSAs
are replicated to each DSA

4 | DirX Directory V9.0

LDAP

DirX Directory

LDAP

LDAP Proxy

DirX Directory
LDAP Server 2

LDAP Clients.json Configuration- Target Server- Rules

LDAP Server 3

Figure 3 - DirX Directory - LDAP Proxyenforcing password policies. Password policies control how passwords
are used and administered in an IT
system. They provide a set of rulesthat ensure that• Passwords meet construction
requirements to prevent users
from choosing easy-to- guess passwords (Password Check Syntax,
Password Minimum Length, Password Maximum Length, Password
Minimum Special Characters,
Password Minimum Lower Case
Characters, Password Minimum
Upper Case Characters, Password
Minimum Numeric Characters,
Forbidden use of sub/super-stringof RDN as password),• Users change their password periodically (Password Minimum Age,
Password Maximum Age, Password Expire Warning, Password
Grace Login Limit),• The re-use of old passwords is
restricted (Password In History,
Password Must Change) and• Accounts are locked out after
failed logins (Password Lockout,
Password Lockout Duration, Password Maximum Failure, Password
Failure Counter Interval).
They also provide information aboutlevel and algorithm of password
hashing (password storage scheme,
password storage scheme level) andcontrol the operational attributes forlast login time and number of failed
logins.
Suppor ted password storage
schemes: plain, hashed, salted-hashed.
Supported password storage hashalgorithms: SHA-1 and SHA-2 (SHA224, SHA-256, SHA-384, SHA-512).
To support the password policy procedures specified by the password
policy, each user entry contains a setof operational attributes that provides information about the status of
the user’s password. This set of attributes provides state information to
support procedures for• Password checking• Password aging• Account lockout• Password administration

Public Key Infrastructure
SupportDirX Director y suppor t s theX.509V3(97) standard for securemanagement of public key certificates. As a result, the storage of certificates and revocation lists, which

Figure 4 - DirX Directory - Nagios Integration Sample
can be produced by Certification
Authorities (CAs), is also supported.
DirX Directory has been successfully
tested with products from leading
CA vendors.

Audit Logging
The purpose of audit logging is torecord information about interactions with the directory for subsequent use. Recorded information is
configurable and includes:• The session ID to identify the connection• The protocol used to access theserver• The identity of the user, if known• The type of directory operation
performed, with a timestamp,
duration, and a summary of its
arguments.
• The result of the operation or thereason for failure• Session tracking control values
such as source IP, source name
This information is placed in an audit
log file and can be used to analyze traffic or to support billing andaccounting management.
Audit logging is supported for all
protocols for both the DirX Directory
DSA and the LDAP server.
For subsequent analysis, commandline tools are provided that allow
summarizing and filtering the audit
log files according to selected criteria.

DirX Directory MIBs
DirX Directory supports MIB information based on RFC 2605 and RFC
2788 as well as DBAM statistics.

The administrator can monitor the
MIB information of both the DSA andLDAP server by using the dirxadm
tool or DirX Manager.

SNMP Support
DirX Directory supports the sendingof SNMPv2 traps according to the
RFC1155 and RFC1905 standards.
Administrators use a configuration
file to set up and enable SNMP operation.
Monitoring the directory service with
SNMP traps can help to detect criticalsituations prior to a severe incident,e.g., lack of resources.

Nagios Support
DirX Directory provides a set of specialized Nagios plugins that can beused in an existing Nagios environment to monitor the status of DirX
Directory service resources and operations and collect statistics about
these items for later performance
analysis.
The DirX Directory Nagios plugins
allow to monitor:• Resources consumed by DirX
Directory processes, such as
memor y allocation and filedescriptors• The responsiveness of DirX Directory processes (the DSA and LDAP
servers) running in standalone andreplication configurations• Resource and operational statistics
kept by the LDAP server in its MIBs
and the changes to these countersover time• Result sizes returned by LDAP
search operations and the durationof LDAP client calls
DirX Directory V9.0 | 5

• The frequency of DirX Directory
database backup operations• The capacity of DBAM devices configured in a DirX Directory installation• The operational status of the
DBAM database• The operating mode of the DirX
Directory service
The DirX Directory Nagios plugins
provide input parameters for specifying warning and critical thresholds tobe monitored for DirX Directory service operations, offering DirX administrators the opportunity to respondto problems detected by the plugins
and displayed by the Nagios server
before they become severe, and to
track their resolution.
The DirX Directory Nagios plugins aredelivered as full-function Perl-based
executables that can be extended
to address customer-specific DirX
Directory monitoring requirements

High-Availability Configuration
DirX Directory is intended to operatein environments where availability,
scalability and performance are ofutmost importance.
Delivering such a platform requires
either a software-based solution or a
combined, integrated hardware andsoftware solution.
As a software solution, one can use
the DirX Directory replication functionality. DirX Directory allows implementing a floating-master concept
by supporting manual and automated mechanisms to easily switch afull shadow server to a master server,
providing a continuous service forboth read and write operations.
As an alternative or an addition toa software- based high-availability
strategy, one can also use a combined, integrated hardware and software solution. While there are various
configurations for such a solution,
three components are of central
importance:• A two-node cluster system• A RAID system connected to bothnodes
• An uninterruptible power supply(UPS) or similar computer center
functionality
Cluster systems are a technologythat connects several nodes (servers)
to a single system image to provide
continuously available systems. Clusters are configured without any pointof failure, including network, cluster
6 | DirX Directory V9.0

interconnect, storage, and software.
Cluster applications like DirX Directory can be implemented as a failover
service: the cluster automaticallyrelocates the application in the eventof node failure. Not every failure has
to lead to a node failover: application watchdogs and other services
may recover on the same node.
The stand-by node can be used forload distribution and performanceenhancement (by a DirX Directory
copy or another application) as longas the primary node is running.
RAID (Redundant Arrays of Independent Disks) is a technology used to
improve data protection and performance while storing large amountsof data. RAID level 10 is the one recommended for the DirX Directory
configuration. RAID level 10 is a combination of level 0 (data striping overmore than two drives, which dramatically improves performance)and level 1 (data mirroring, wheredata are copied automatically to asecond set of drives, offering gooddata protection and fast recovery). In
addition, the mirror disks contributeto the performance by doubling theread throughput.

Supervisor
Automated switching in a floating-master configuration is supported by the script-based DirX
Directory Supervisor that provides forcontinuous, periodic monitoring on
replication and network connectivity level between the DirX Directory
service instances. The Supervisor
scripts can be customized to adjust
the triggering conditions for switching a full shadow server to a masterserver automatically.

Scalability
DirX Directory has a highly scalable
architecture regarding both thenumber of entries it can store andthe number of concurrent users andqueries it supports.
Database scalability:• One server can store and manage
tens of millions of entries, including
all the necessary indices.
• An unlimited number of entries
can be stored below one single
node.
• For optimal storage of large attribute values, outsourcing of attributes is supported.
• For unlimited scalability, several
servers can be connected to set
up a distributed directory system.
The complete data of all connected

DirX Directory servers is accessible
for read and write operations.
User queries and throughput scalability:• Optimized indexing for fast andefficient search operations• Multi-level caching, automaticcache preload and tuning of cachesizes• Multi-threaded server architecture
provides linear scalability based on
the number of processors• Use of high-performance disk subsystem (e.g., RAID 10) or SANs
• Load distribution based on replication and distribution of data tomultiple servers• Multi-version DBAM to optimize throughput during update
operations, allowing one update
operation and multiple retrieval
operations in parallel• LDAP and DSA servers can be
deployed on separate machines• Multiple LDAP servers can be connected to one DSA server or one
LDAP server can be connected tomultiple DSAs for optimal load distribution.

Administration
DirX Directory provides a number ofadministration tools:
The dirxload component is ahigh-performance bulk-loading tool
used to load large amounts of data
off-line directly into the database.
The dirxmodify component is abulk-loading and checking tool that
operates over LDAP.
The dirxadm/dirxcp components andthe DirX Manager graphical interface
are used for DirX Directory administration. dirxcp and dirxadm are basedon the shell-like command language
Tcl (Tool Command Language). Tcl
supports the use of variables, conditional statements, list- processing
functions, looping and other features of well-known command languages. These features permit theimplementation of shell scripts forbatch processing, and consequently
allow simple system customizing.
The dirxcp/dirxadm programs supplement
these functions by providing predefinedcommands for the management of
DirX Directory administration objects
and for simplifying the routine tasksof the DirX Directory administrator.
The dirxadm/dirxcp tools can beused in two different modes:• In interactive mode, in which individual commands are entered in a
dialog and results are displayed• In command mode, in whichwhole series of commands can be
executed.
The dirxbackup program is a command-line tool for saving and restoring the DBAM database to and froma DBAM database archive.
The dirxload component
The dirxload component is an off-line
bulk- loading tool used to load large
amounts of data in an optimized
and efficient way. This bulk- loading tool can be used for initial loading, populating the database or for
subsequent additions to the database. The administrator can specify
one or more LDIF content files toload directly into a DBAM database.
Optionally, dirxload can be configured to perform attribute indexing
during the load operation.
The dirxmodify component
The dirxmodify component processes LDIF content or change files
and performs the modifications over
LDAPv3 to the directory database. It
is a stand-alone tool that can be run
locally or from a remote machine.
dirxmodify is a very powerful toolwith many on-the-fly processing
options that can also be used off-line
for checking LDIF files and generating statistics.

operations such as generate new
objects, change, delete, and searchfor objects/entries in the directory
information tree (DIT),

ferential saving without service interruption. Both retrieval and update
operations are allowed during the
backup.

• Execute queries on objects in the
DIT,

The dirxbackup tool saves, restoresand verifies a DBAM database. The
tool can be used in conjunction witha file compress/uncompress toolsuch as gzip.

• Change parameters to change thebehavior of operations and• Display abbreviations used for
attributes and object identifiers.
The dirxadm component
The dirxadm tool is a set of commands that allow the system administrator to manage LDAP servers
and DSAs; for example, DSA- specificentries (DSEs) and operational attributes.
The commands are used to:• Manage the local DSE and DSA
policies• Manage the links between two
DSAs (operational bindings for
replication events and distributionof directory data among two DSAs)• Configure the DSA database• Display monitoring information
stored in the Management Information Base of the DSA• Perform administration tasks suchas
• Starting/terminating the servers
and• Enabling/disabling logging.
The dirxbackup component
DirX Directory provides full and dif-

The commands are used to:• Save a DBAM database in a database archive• Restore a DBAM database from a
database archive• Verify a database archive for consistency
DirX Manager
DirX Manager, a Java-based LDAP
management client, provides a configurable, platform-independentgraphical administration interface
for local and remote administrationof DirX Directory.
The main features provided by DirX
Manager are:
• Entry management (add, delete,modify)• Browsing and searching of thedirectory• Schema management over LDAP
• Replication management over
DirX Directory RPC• Display of indices• Management and display of subentry information

In particular, dirxmodify:• Supports anonymous and simple
authenticated bind to the LDAP
server• Converts ISO-8859-1 (Latin-1) characters to UTF-8 characters• Checks the LDIF files off-line forsyntactical correctness and displays statistics about attributes,
entries, and nodes in the file
• Performs simple queries directlyon the LDIF file
• Replaces attribute values andtypes on-the-fly from the file into
the directory• Ignores selected attributes forloading
The dirxcp component
The dirxcp tool is a command-driven
directory client that can be used byadministrators or users to communicate with an LDAP server over LDAP
or directly with a DSA over DAP. It is
used to:• Send requests to DSAs to perform

Figure 5 - DirX Manager - Schema Management

DirX Directory V9.0 | 7

• Password policy management• Proxied authorization control management• Directory monitoring view for
LDAP and DSA over LDAP-extended operations• Management of multiple servers• Import from LDIF content andchange files and from DSMLv1 andDSMLv2 files into the directory• Export of selected directory content into DSMLv1, DSMLv2 or LDIF
content files• SSL server authentication• Customizable logical views• Setup of scripts and execution of
dirxcp and dirxadm in a GUI pane
• Support of simple paging

Logging of system events
DirX Directory offers two levels ofprogram monitoring:• System error and status reports• Monitoring of program execution
The administrator can configure
which messages are logged, in which
form, and where they are stored. On
UNIX systems, error and status messages can also be passed to the UNIX
syslog daemon.

Integration on Windows
platforms
The administration of DirX Directoryis adapted to and integrated into thesystem environment on Windows
platforms:• Display of logging information
with the Event Viewer• DirX Directory runs as a Windows
service and can be managed byWindows Service Administration

Support of 64-Bit Architectures
DirX Directory runs as native 64-bit
application with Red Hat EnterpriseLinux, SUSE Linux Enterprise Server
as well as Microsoft Windows Server
on x86-64 architectures (Intel).

Compliance with standards
and interoperability
DirX Directory complies with Internet
LDAP standards: RFCs 1155, 1274, 1277,
1905, 2222, 2247, 2279, 2377, 2559,
2587, 2596, 2696, 2798, 2849, 2891,
3045, 3673, 4370, 4510, 4511, 4512,
45131, 4514, 4515, 4516, 4517, 45182,
4519, 4529, 6171, MIB information
based on RFC 26053 and 27883
DirX Directory also complies with
8 | DirX Directory V9.0

the following ITU-T and ISO/IEC standards:
ITU-T X.500, X.501, X.511, X.518, X.519,
X.520, X.521, X.509, X.525
ISO/IEC 9594-1, 9594-2, 9594-3, 95944, 9594-5, 9594-6, 9594-7, 9594-8,
9594-91993 profiles:
ADY11, ADY12, ADY21, ADY22, ADY41,
ADY42, ADY43, ADY44, ADY45, ADY51,
ADY53, FDY11, FDY12
In addition to IPv4, DirX Directory
supports IPv6 for the following protocols:• LDAP• X.500 DAP/DSP/DISP (IDM-based)
By means of configuration, administrators can choose the IP version supported for incoming traffic and used
for outgoing traffic.

System Requirements
Hardware

SoftwareUser Interface• Intel server platform for Microsoft
Windows Server 2019 and 2022

• Microsoft Windows Server 2019and Windows Server 2022

• English• Red Hat Enterprise Linux 7 and 8• Red Hat Enterprise Linux Server 7
and 8 (x86-64)

Documentation• SUSE Linux Enterprise Server 12
and 15
Memory Requirements:
Main memory:

minimum 8 GB

Disk Space:		minimum 4 GB plus
disk space for data

• SUSE Linux Enterprise Server 12
and 15 (x86-64)• Microsoft Windows 10 and Windows 11 (x86-64, DirX Manager
only)with the latest patches/service packs
for the selected platform
Support of cluster configurations isavailable on request
Virtual Machine Support:• VMWare ESXi in combination
with guest operating systems
listed above that are supported by
VMWare ESXiFor DirX Manager• Java SE Runtime Environment 11(see dependencies on selected
operating system)

Manuals are provided in English.
Manuals
The following DirX Directory documentation is available electronicallyin PDF:• Introduction Guide• Administration Guide• Administration Reference• Disc Dimensioning Guide• External Authentication• LDAP Proxy• LDAP Extended Operations• Manager Guide• Plugins for Nagios• Supervisor• Syntaxes and Attributes• Guide for CSP Administrators• For smart card support: Atos
CardOS API V5.3/V5.4 in combination with CardOS smart cards thatare supported by Atos CardOS API
V5.3/V5.4
For Supervisor• Perl and perl-ldap distribution
latest release• On Windows: Perl 5.16.3 or newer• On Linux: Perl 5.8 or newer
For Nagios Integration• Nagios Core Version 3.4.4• Perl and perl-ldap distribution
latest release• On Windows: Perl 5.16.3 or newer• On Linux: Perl 5.8 or newer

DirX Directory V9.0 | 9

DirX Product Suite
The DirX product suite provides the basis for fully integrated identityand access management; it includes the following products, which canbe ordered separately.

DirX Identity
DirX Identity provides a comprehensive, process-driven,customizable, cloud-enabled, scalable, and highly available identity management solution for businesses andorganizations. It provides overarching, risk-based identity and access governance functionality seamlessly
integrated with automated provisioning. Functionality includes lifecycle management for users and roles,
cross-platform and rule-based real-time provisioning,
web-based self-service functions for users, delegatedadministration, request workflows, access certification,
password management, metadirectory as well as auditing and reporting functionality.

DirX Directory
DirX Directory provides a standards-compliant, high-performance, highly available, highly reliable, highly scalable,
and secure LDAP and X.500 Directory Server and LDAP
Proxy with very high linear scalability. DirX Directory canserve as an identity store for employees, customers, partners, subscribers, and other IoT entities. It can also serve asa provisioning, access management and metadirectory
repository, to provide a single point of access to the information within disparate and heterogeneous directories
available in an enterprise network or cloud environment
for user management and provisioning.

DirX Access
DirX Access is a comprehensive, cloud-ready, scalable,
and highly available access management solution providing policy- and risk-based authentication, authorization based on XACML and federation for Web applications
and services. DirX Access delivers single sign-on, versatile authentication including FIDO, identity federation
based on SAML, OAuth and OpenID Connect, just-intime provisioning, entitlement management and policy
enforcement for applications and services in the cloud or
on-premises.

DirX Audit
DirX Audit provides auditors, security compliance officers and audit administrators with analytical insight andtransparency for identity and access. Based on historical identity data and recorded events from the identityand access management processes, DirX Audit allows
answering the “what, when, where, who and why” questions of user access and entitlements. DirX Audit features
historical views and reports on identity data, a graphicaldashboard with drill-down into individual events, an analysis view for filtering, evaluating, correlating, and reviewing of identity-related events and job management forreport generation. With its analytical features, DirX Audit
helps enterprises and organizations to ensure sustainable
compliance and provide business intelligence for the riskbased identity and access management processes.

Eviden is a registered trademark © Copyright 2023, Eviden SAS – All rights reserved.

DS-230613-GW-DirX_Directory_V9.0_Datasheet_EN