Chapter 1. Introduction to directory services Red Hat Directory Server provides a centralized directory service. Directory Server integrates with existing systems and acts as a centralized repository for the consolidation of employee, customer, supplier, and partner information. With Directory Server, you can manage user profiles and authentication. Learn what you need to understand before designing your directory in the following chapters. 1.1. About directory services A directory service is a collection of software, hardware, and processes that store information about an enterprise and provides access to this information to users. The directory service consists of at least one Directory Server instance and one directory client application. Client application can access names, phone numbers, addresses, and other data stored in the directory. An example of the directory service is a domain name system (DNS) server. DNS maps computer hostnames to IP addresses. A DNS client sends request to a DNS server and the server replies which IP address the server.example.com has. Therefore, all hosts become clients of the DNS server. In addition, users can easily locate computers on a network by remembering hostnames rather than IP addresses. A limitation of a DNS server is that it stores only two types of information: hostnames and IP addresses. A true directory service stores virtually unlimited types of information. In Red Hat Directory Server, you can store the following data in one network-accessible repository: Physical device information, such as data about the printers in an organization: location, manufacturer, date of purchase, and serial number. Public employee information: name, email address, and department. Private employee information: salary, government identification numbers, home addresses, phone numbers, and pay grade. Contract or account information: the name of a client, final delivery date, bidding information, contract numbers, and project dates. Directory Server provides a standard protocol and application programming interfaces (APIs) to access the information it contains and serves the needs of many applications. 1.1.1. About global directory services Red Hat Directory Server provides global directory services by providing information to a wide variety of applications. Until recently, many applications came bundled with their own proprietary user databases, with information about the users specific to that application. While a proprietary database is convenient if you use only one application, multiple databases become an administrative burden if the databases manage the same information. For example, a company runs three different proprietary email systems, and each email system has its own proprietary directory service. If users change their passwords in one directory, the changes are not automatically replicated to other directories. Management of the same information in different places increases the hardware and personnel costs. The increased maintenance overhead is referred to as the n+1 directory problem . A global directory service solves the n+1 directory problem by offering a centralized repository accessible to any application. However, giving a wide variety of applications access to the directory service requires a network-based means of communicating between the applications and the directory service. Red Hat Directory Server uses LDAP for applications to access to its global directory service. 1.1.2. About LDAP LDAP provides a common language that client applications and servers use to communicate with one another. LDAP is a "lightweight" version of the Directory Access Protocol (DAP) that the ISO X.500 standard describes. DAP gives any application access to the directory through an extensible and robust information framework but at a high administrative cost. DAP uses a communications layer that is not the Internet standard protocol and has complex directory-naming conventions. LDAP preserves the best features of DAP while reducing administrative costs. LDAP uses an open directory access protocol running over TCP/IP and simplified encoding methods. It retains the data model and can support millions of entries for a modest investment in hardware and network infrastructure. 1.2. Introduction to Directory Server Red Hat Directory Server has several components. The directory core is the server that implements the LDAP protocol. You can use different LDAP clients, third-party and custom applications written by using LDAP SDKs, with Red Hat Directory Server. Red Hat Directory Server installation includes the following elements: The core Directory Server LDAP server, the LDAP v3-compliant network daemon ( ns-slapd ) and all the associated plug-ins, command-line tools for managing the server and its databases, and its configuration and schema files. Learn more in Configuring directory databases , and Configuration and schema reference . Web console, a graphical management console that simplifies directory service set up and maintenance. Learn more in Logging in to the Directory Server by using the web console . SNMP agent to monitor Directory Server using the Simple Network Management Protocol (SNMP). Learn more in Monitoring Directory Server using SNMP . Directory Server provides a foundation for an intranet or extranet without other LDAP client applications. Compatible server applications use the directory as a central repository for shared server information, such as employee, customer, supplier, and partner data. Directory Server manages user authentication, access control, user preferences. In hosted environments, partners, customers, and suppliers can manage their directory parts, reducing administrative costs. Directory Server relies on plug-ins for added functionality, like the database layer, replication, and chaining databases. You can disable plug-ins that are not related to the core directory services operations. 1.2.1. Overview of the Directory Server frontend Directory Server is a multi-threaded application. It means that multiple clients can bind to the server at the same time over the same network. When directory services expand to include larger numbers of entries or geographically-distributed clients, the services also include multiple Directory Servers placed in strategic places around the network. The server frontend of Directory Server manages communications with directory client applications using LDAP over TCP/IP and LDAP over Unix sockets (LDAPI). Directory Server can establish a secure (encrypted) connection with Transport Layer Security (TLS), depending on if the client negotiates to use TLS for the connection. If clients were issued certificates, Directory Server can use TLS to confirm that the client has the right to access the server. In addition, TLS is used to perform other security activities, such as message integrity checks, digital signatures, and mutual authentication between servers. 1.2.2. Overview of the basic Directory Server tree The directory tree, also known as a directory information tree (DIT), mirrors the tree model used by most file systems. During installation, Directory Server creates a default directory tree. A default directory tree After an installation, the directory contains the following root suffix and subtrees: Root DSE (Root DSA-specific entry) is a a special entry of LDAP servers. The Root DSE distinguished name (DN) is the zero-length string. cn=config contains information about the server internal configuration. cn=monitor contains server and database monitoring statistics. cn=schema contains the schema elements currently loaded in the server. user root suffix , the suffix for the default user database that Directory Server creates during setup. You define the user root suffix name when you create the Directory Server instance. The user root suffix often has a dc naming convention, such as dc=example,dc=com , or it uses the o attribute for organizations, such as o=example.com . For information about naming the user suffixes, see Choosing the suffix . The root user suffix is associated with the userRoot database. You populate the database later by importing LDIF files or creating entries. You can extend the default directory tree by adding any data relevant to the directory installation. For more information about directory trees, see Designing the directory tree . 1.3. Directory server data storage A database is the basic unit of storage, performance, replication, and indexing. You can do operations such as importing, exporting, backing up, restoring, indexing on the database. Directory Server stores the data in the LDAP Database Manager (LDBM) database. The LDBM database is implemented as a plug-in that is automatically installed with the directory and is enabled by default. By default, Directory Server uses one backend database instance for a root suffix, and a single database is sufficient to contain the directory tree. This database can manage millions of entries. This database supports advanced methods of backing up and restoring data to minimize data loss. However, you can use multiple databases to support the entire Directory Server deployment to manage more data than can be stored in a single database. 1.3.1. About directory entries LDAP Data Interchange Format (LDIF) is a standard text-based format for describing directory entries. An entry consists of a number of lines in the LDIF file and contains information about an object, such as a person in the organization or a printer on the network. Information about the entry is represented as a set of attributes and their values. Each entry has an object class attribute that specifies the type of an object the entry describes and defines the set of additional attributes it contains. Each attribute describes a particular trait of an entry. For example, an entry can have organizationalPerson object class indicating that the entry represents a person in an organization. This object class supports the givenName and telephoneNumber attributes. The values assigned to these attributes define the name and phone number of the person the entry presents. Directory Server also uses read-only operational attributes that the server calculates. Administrators can manually set these operational attributes for access control and other server functions. Performing searches of directory entries The directory tree stores entries in a hierarchical structure. LDAP supports tools that query the database for an entry and request all entries below branches in the directory tree. The root of branch subtree is called the base distinguished name, or base DN . For example, if performing an LDAP search request specifying a base DN of ou=people,dc=example,dc=com , the search operation checks only the ou=people subtree in the dc=example,dc=com directory tree. By default, an LDAP search does not return all entries and excludes administrative entries that have the ldapsubentry object class. Administrative entries can be used to define a role or a class of service. To include these entries in the search response, client applications need to additionally search for entries with the ldapsubentry object class. Additional resources About roles in Directory Server Finding entries using the command line (ldapsearch) 1.3.2. Distributing directory data If you store parts of the directory tree in a separate database, the directory can process client requests in parallel improving performance. You can even store databases on different machines for further performance improvement. To connect part of the directory, Directory Server uses database links and chaining. For more information about database links and chaining, see Using referrals in Directory Server . Additional resources Distributing the directory data 1.4. Design process outline Planning the directory data The directory contains data, such as user names, telephone numbers, and group details. The planning chapter help you to analyze various sources of data in the organization and understand their relationship. Understand which types of data your directory can store and tasks to perform to design the contents of the Directory Server. Designing the directory schema The directory is designed to support one or more directory-enabled applications. These applications have requirements of the data that the directory stores, such as the file format. The directory schema determines the characteristics of this data. Learn about the standard schema shipped with Directory Server, description of how to customize the schema, and tips for maintaining a consistent schema. Designing the directory tree Determine how you will organize and reference stored data after reading the overview of the data hierarchy design and examples. Designing the directory topology Learn about the topology design if you plan to divide the directory among multiple physical Directory Servers and how these servers communicate with one another. Designing the replication process Learn about replication concepts, types of replicable data, various replication scenarios, and high-availability directory service tips. Designing a secure directory Find how you can protect your directory. Learn about security threats, security methods overview, steps in analyzing security, and tips for designing access controls to protect directory data integrity. Designing synchronization In a mixed-platform infrastructure, consider synchronization with information stored in Microsoft Active Directory databases. 1.5. Deploying the directory First, install a test server instance to ensure the service can handle the user load. If the service does not have optimal initial configuration, adjust the design and test it again. Adjust the design until it meets the enterprise needs. After creating and tuning a successful test Directory Server instance, develop a plan to move the directory service to production with the following considerations: An estimate of the required resources A schedule of what needs to be accomplished and when A set of criteria for measuring the success of the deployment 1.6. Additional resources Key resources on directories, LDAP, and LDIF: RFC 2849: The LDAP Data Interchange Format (LDIF) Technical Specification RFC 2251: Lightweight Directory Access Protocol (v3)

Commands: