Red Hat Directory Server

Size: px

Start display at page:

Download "Red Hat Directory Server"

Myles Peters
5 years ago
Views:

1 Red Hat Directory Server HP User Society / DECUS 17. Mai 2006 Joachim Schröder Red Hat GmbH

2 How Identity Management can Save In a one year period in a typical 10,000 user organization: 54,180 employee hours are spent administrating users, user stores, and authentication and entitlement. 2,666 employee hours are spent logging on applications. 45% of help desk calls are password related, and deploying Identity management will reduce help desk call volumes by 33% and a 32% increase in overall security. META Group research conducted on behalf of PricewaterhouseCoopers, June 2002 With Identity Management / Red Hat Directory Server: Improve TCO from Efficient Management and Access

Netscape Certificate Management System (Red Hat Certificate System) Netscape

3 A bit of history... Dec. 8, 2004 : Red Hat acquires AOL's Netscape Security Solutions business unit Netscape Certificate Management System (Red Hat Certificate System) Netscape Directory Server (Red Hat Directory Server) Netscape Enterprise Server Code outsourced Fedora DS downloads... A leading OSS product already 3

4 Access Control Information Red Hat Directory Server Network centric, Centralized LDAP Data Store for: Application Settings User Profiles Group Data Policies Access Control Information Users Customers Red Hat Directory Server Systems Data Scalable Identity Management Applications Resources

5 Sample Directory Information Tree (DIT) The organization dc=redhat, dc=com itself ou=people ou=engineering ou=servers ou=sales cn=engweb uid=bjensen A person entry Organizational units (departments) A server entry 5

6 Red Hat Directory Server: Scalable Identity LDAP based authentication ( who are you ): Widely supported; OS access through NIS or PAM gateway Supports Kerberos via SASL Integrated support for X.509 certificates Supports databases, legacy systems via plug-in API Fine-grained access control ( what can you do ) Using external criteria type of connection, day of week/time, hostname/ip Role-Based Access Control - groups ( engineering ) and roles ( managers ) High availability and scalability through Multi-Master Replication

7 Red Hat Directory Server : key features Master-slave, multi-master replication Service continuity Scalability Load balancing Sophisticated access control HTTP applications phonebook org chart SNMP support Schema extensions : LDIF

8 Red Hat Directory Server : key features (cont.) Plug-ins New syntaxes... SDKs & tools API C/C++, Java, Perl DSML/XML support Strong authentication GSS/SASL : Kerberos WinSync Dir. Srv. SSL TLS Active Dir.

Admin. client Admin. server Target server Admin.

9 Administration architecture Modular yet homogeneous architecture Configuration data stored in directory 3 levels Admin. client Admin. server Target server Admin. client HTTP Admin. server Custom applications possible o=netscaperoot Target servers

10 RHDS : configuration data stored in directory Custom applications made easier o=netscaperoot

11 DS administration

12 What Is Multi-Master Replication? Master copies reside on multiple servers Masters can be situated in different data centers, different geographic areas Changes to data can be made to closest server, and are then propagated to the other masters Failover ensures continuous service Automatic time based conflict resolution Not appropriate for every deployment adds some complexity 12

13 Replication RHDS' key feature Multi-master, master-slave Highly reliable mechanim changelog

14 Typical multi-master configuration Updateable Masters Replica Hubs (image masters) Read-Only Replicas (specialized directories)

15 MMR Example: Over WAN Office 1 Enterprise with remote offices connected via WAN Office 2 Master (New York) Master (Brisbane) WAN Replicas Replicas

16 MMR Example: Frequent Searches/Updates Enterprise application with high search and update rates Master Replicas Load Balancer Query Client Update Masters Load Balancer Master Replicas 16

17 Winsync RHDS-Microsoft replication Active Directory NT (product installs an LDAP instance Dir. Srv. SSL TLS Active Dir.

18 Plugins Insert custom code Syntaxes,... Pre/Post LDAP processing Password management New backend Example : Uniqueness plugin uids Every plugin has a DN cn=plugin_name, cn=plugin, cn=config Parameters allowed

19 Plugins (cont.)

20 Access control Who is allowed to do what? For every Directory object Typical ACI aci: (targetattr="userpassword homephone homepostaladdress") (version 3.0; acl "Write example.com"; allow (write) userdn= "ldap:///self" and dns="*.example.com";) ACI editor to ease writing instructions

21 Bind rules Who can bind to the Directory, when,from where Managed attributes Userdn, groupdn, roledn IP_address, DNS_host_name dayofweek Authmethod (SASL...)

22 Monitoring SNMP agent Local status data available

23 HTTP application : DirExpress

24 HTTP application : Org. Chart

25 Annex : Certificate System An highly sophisticated PKI Certificate Authority (CA) Smartcards & software tokens support Data Recovery Manager (DRM) Private keys secure storage Needed for key recovery Online Certificate Status Protocol (OCSP) Responder Creates X.509 certificates & CRLs Token Management System (TMS) To manage the whole lifecycle of a certificate Provides certificates status in real time Token Key Service (TKS) Inter subsystems communication services

26 Questions?

27 Vielen Dank! Joachim Schröder, Solution Architect

Red Hat Directory Server Red Hat Directory Server 9 Updates Available in Red Hat Enterprise Linux 6.4

Red Hat Directory Server Red Hat Directory Server 9 Updates Available in Red Hat Enterprise Linux.4 Enhancements to the 389-ds Package Edition 9.0.1 Ella Deon Lackey Red Hat Directory Server Red Hat Directory