Internet infrastructure

1
Internet infrastructure

• Prof. dr. ir. André Mariën

2
LDAP Data modelling
3
Data modelling

• Inventory
• Applications
• Information classes
• Data elements
• Example
• Mail system
• userID, password, email address, mail host,
  forwarding address

4
Data element description

• Format
• Number of occurrences (single-multiple)
• Data ownership
• Information consumers

5
Format selection

• Text string
• Case sensitive/case insensitive
• Example names, URL
• Numeric
• Integer/floating point
• Example employee number
• Binary
• Example certificates, keys

6
Attributes
7
Important Attributes

• cn
• commonName
• name of an object
• for a person, it is typically the person's full
  name
• a webserver its DNS name
• a web certificate an email address

8
Important Attributes

• o
• organizationName
• ou
• organizationalUnitName
• Attributes address c
• country
• two-letter ISO 3166 country code

9
Important Attributes

• l
• localityName
• locality city, county, geographic region
• st
• stateOrProvinceName
• a state or province
• street
• streetAddress

10
Important Attributes

• member
• used in grouping constructs
• also used for authentication and authorization
• each value a DN of a 'member' object
• owner
• links objects to object owner DN
• example devices to responsible
• could be used as 'father' link in groups

11
Attributes

• person
• givenName
• initials
• generationQualifier
• sn
• surname the family name of a person.
• userPassword

12
Attributes structural

• distinguishedName
• a base type from which attributes with DN syntax
  inherit
• not used as the name of the object itself
• uniqueMember
• name
• attribute supertype
• string attribute types for naming are derived
  from this will not occur in an entry

13
Classes
14
Object Class top

• ABSTRACT
• MUST objectClass

15
Object Class person

• SUP top
• STRUCTURAL
• MUST ( sn cn )MAY ( userPassword
  telephoneNumber seeAlso description )

16
Object Class organizationalPerson

• SUP person
• STRUCTURAL
• MAY ( title registeredAddress
  destinationIndicator telephoneNumber
  internationaliSDNNumber facsimileTelephoneNumber
  street postOfficeBox postalCode
  postalAddress ou st l ... )

17
Object Class organization

• SUP top
• STRUCTURAL
• MUST o
• MAY ( userPassword searchGuide seeAlso
  businessCategory telexNumber
  teletexTerminalIdentifier telephoneNumber
  street postOfficeBox postalCode
  postalAddress st l description )

18
Object Class organizationalUnit

• SUP top
• STRUCTURAL
• MUST ou
• MAY ( userPassword searchGuide seeAlso
  businessCategory telexNumber telephoneNumber
  street postOfficeBox postalCode
  postalAddress st l description )

19
Object Class groupOfNames

• SUP top
• STRUCTURAL
• MUST ( member cn )
• MAY ( businessCategory seeAlso owner ou o
  description )

20
Object Class groupOfUniqueNames

• SUP top
• STRUCTURAL
• MUST ( uniqueMember cn )
• MAY ( businessCategory seeAlso owner ou o
  description )

21
Deployment
22
Deployment considerations

• Load balancing
• Local reference
• Master slave
• Write master read slaves
• Partial replication
• Meta directory

23
Master - Slave
Oxxx.com
Oxxx.com
Replication
Updates
Bulk access
24
Topologies

• N identical servers with full replication for
  load distribution
• N subtree servers
• Virtual top
• Top level server with referral
• Multiple locations for latency reduction
• Mix of the above

25
N identical servers with full replication for
load distribution
Oxxx.com
Oxxx.com
Oxxx.com
26
N subtree servers Virtual top
oxxx.com
lBE,oxxx.com
lUS,oxxx.com
lIT,oxxx.com
27
N subtree servers Top level server with referral
oxxx.com
lBE,oxxx.com
lUS,oxxx.com
lIT,oxxx.com
28
Multiple locations for latency reduction
Italy
Belgium
United States
Oxxx.com
Oxxx.com
Oxxx.com
29
Support for infrastructure

• Standard LDIF import export

30
Import - export
31
LDIF

• RFC 2849
• LDAP Data Interchange Format

32
LDIF

• a file format for describing
• directory information
• directory modifications
• a series of records separated by line separators
• a sequence of lines describing either
• a directory entry
• a set of changes to an entry

33
LDIF simplified

• File with either
• LDIF directory data
• LDIF directory modification commands

34
Directory data

• List of entries with header
• Dn ltdistinguished namegt
• List of attribute value pairs
• ltAttributegt gtltoptiongt,ltoptiongt,... ltvaluegt
• Attribute is either attribute type OID or name

35
LDIF directory changes

• List of entries with header
• Dn ltdistinguished namegt
• List of operations on objects
• changetype (add delete modify)
• Modify which attributes, how
• (add delete replace ) attribute
• Data
• -

36
LDIF example 1

• version 1
• dn cnAndre Marien, ouMarketing, dcmymarket,
  dccom
• objectclass top
• objectclass person
• objectclass organizationalPerson
• cn Andre Marien
• sn Marien
• uid amarien
• telephonenumber 1 401 555 1007
• description A big spender

37
LDIF example 2

• version 1
• dn cnBob Davids, ouMarketing, dcairius,
  dccom
• changetype add
• objectclass top
• objectclass person
• objectclass organizationalPerson
• cn Bob Davids
• sn Davids
• uid bob
• telephonenumber 1 408 555 1212

38
LDIF example 3

• version 1
• dn cn Bob Davids, ouMarketing, dcairius,
  dccom
• changetype delete

39
LDIF example 4

• version 1
• dn cn Andre Marien, ou Marketing, dc
  mymarket, dccom
• changetype modify
• replace telephonenumber
• 1 408 555 1212
• -
• delete description
• -

40
References

• "LDAP", RFC 1777
• LDAP (v3)", RFC 2251
• LDAP (v3) UTF-8 String Representation of DNs",
  RFC 2253
• "A Summary of the X.500(96) User Schema for use
  with LDAPv3", RFC 2256

41
References

• LDAP (v3) Attribute Syntax Definitions", RFC
  2252
• "The LDAP URL Format", RFC 2255
• The LDAP Data Interchange Format (LDIF) -
  Technical Specification, RFC 2849

42
References

• X.680, "ASN.1 - Specification of Basic Notation"
• The Directory Selected Attribute Types. ITU-T
  Recommendation X.520, 1993.
• The Directory Models. ITU-T Recommendation
  X.501, 1993.
• X.690, "Specification of ASN.1 encoding rules
  Basic, Canonical, and Distinguished Encoding
  Rules"

43
References

• SASL", RFC 2222
• Universal Multiple-Octet Coded Character Set
  (UCS) - Architecture and Basic Multilingual
  Plane, ISO/IEC 10646-1
• "UTF-8, a transformation format of Unicode and
  ISO 10646", RFC 2044