Directory service 334641 225986634 2008-07-16T09:48:43Z 78.86.116.238 /* hgfhfghgfComparison with relational databases */ Before defining what is a '''directory service''' one must understand what is meant by a '''directory'''. Fundamentally, a directory is like a dictionary; it allows one to look up a name and retrieve items of information associated with that name. Just like a word in a dictionary may have multiple definitions, multiple different pieces of information may be associated with a given name. And just like a word may have different parts of speech, with different definitions associated, a name in a directory may also have many different types of data. Unlike a typical dictionary, the names in a directory are organized in a hierarchical tree, and each node in the tree represents a valid name that may have its own set of associated data. (In fact, a dictionary is just a degenerate case of a directory, where the hierarchy is only one level deep.) Directories may be very narrow in scope, supporting only a small set of node types and data types, or they may be very broad, supporting an arbitrary or extensible set of types. E.g., in a dictionary, all of the nodes are words. In a telephone directory, all of the nodes are names and the data items are mainly just telephone numbers. Those are two very simple examples of directories. In the [[Domain Name System|DNS]] all of the nodes are domain names or internet addresses. DNS uses a slightly more complex directory, with hierarchical names, but the set of types used in DNS is not easily extensible. In the directory used by a network operating system, the nodes represent resources that are managed by the OS, including users, computers, printers and other shared resources, etc. A directory service is simply the software system that stores and organizes information in a directory, and provides access to that information. Many different directory services have been used since the advent of the Internet. The discussion here focuses mainly on the [[X.500]] directory service. == Introduction == A simple directory service called a naming service maps the names of network resources to their respective network addresses. With the name service type of directory, a user doesn't have to remember the physical address of a network resource; providing a name will locate the resource. Each resource on the network is considered an object on the directory server. Information about a particular resource is stored as attributes of that object. Information within objects can be made secure so that only users with the available permissions are able to access it. More sophisticated directories are designed with namespaces as Subscribers, Services, Devices, Entitlements, Preferences, Content and so on. This design process is highly related to [[Identity management]]. A directory service defines the [[Namespace (computer science)|namespace]] for the network. A namespace in this context is the term that is used to hold one or more objects as named entries. The directory design process normally has a set of rules that determine how network resources are named and identified. The rules specify that the names be unique and unambiguous. In [[X.500]] (the directory service standards) and [[Lightweight Directory Access Protocol|LDAP]] the name is called the '''distinguished name''' (DN) and is used to refer to a collection of attributes (relative distinguished names) which make up the name of a directory entry. A directory service is a shared information infrastructure for locating, managing, administrating, and organizing common items and network resources, which can include volumes, folders, files, printers, users, groups, devices, telephone numbers and other objects. A directory service is an important component of a [[Network operating system|NOS]] (Network Operating System). In the more complex cases a directory service is the central information repository for a [[Service Delivery Platform]]. For example, looking up "computers" using a directory service might yield a list of available computers and information for accessing them. Replication and Distribution have very distinct meanings in the design and management of a directory service. The term replication is used to indicate that the same directory namespace (the same objects) are copied to another directory server for redundancy and throughput reasons. The replicated namespace is governed by the same authority. The term distribution is used to indicate that multiple directory servers, that hold different namespaces, are interconnected to form a distributed directory service. Each distinct namespace can be governed by different authorities. == Comparison with relational databases == There are a number of things that distinguish a traditional directory service from a [[relational database]]. * Depending on the directory application, the information is generally read more often than it is written. Hence the usual database features of transactions and rollback are not implemented in some directory systems. Data may be made redundant, but the objective is to get a faster response time during searches. * Data can be organized in a strictly hierarchical manner which is sometimes seen to be problematic. To overcome the issues of deep namespaces, some directories dismantle the object namespace hierarchy in their storage mechanisms in order to optimize navigation. That is, these directories find the item based on their data attributes and then determine their namespace values as this is faster than navigating large namespaces to find the item. In terms of [[cardinality]], traditional directories do not have many-to-many relations. Instead, such relations must be maintained explicitly using lists of distinguished names or other identifiers (similar to the cross table identifiers used in relational databases). * Originally X.500 type directory information hierarchies were considered problematic against relational data designs. Today Java based object-oriented databases are being developed and XML document forms have adopted an hierarchical object model - indicating an evolution from traditional relational data engineering. * A schema is defined as object classes, attributes, name bindings and knowledge (namespaces). * An objectClass has: ** Must-attributes that each of its instances must have ** May-attributes that can be defined for an instance, but could also be omitted when the object is created. The lack of a certain attribute is somewhat like a NULL in relational databases * Attributes are sometimes multi-valued in directories allowing multiple naming attributes at one level such as machine type and serial number concatenated or multiple phone numbers for "work phone". * Attributes and objectClasses are standardized throughout the industry and formally registered with the [[Internet Assigned Numbers Authority|IANA]] for their object ID. Therefore directory applications seek to reuse much of the standard classes and attributes to maximize the benefit of existing directory server software. * Object instances are slotted into namespaces. That is, each objectClass [[Inheritance (computer science)|inherits]] from its parent objectClass (and ultimately from the root of the hierarchy) adding attributes to the must/may list. * Directory services are often a central component in the [[Computer security|security]] design of an IT system and have a correspondingly fine granularity regarding access control: who may operate in which manner on what information. Also see: [[Access control list|ACLs]] Directory design is quite different from relational database design. With databases one tends to design a data model for the business issues and process requirements, sometimes with the online customer, service, user management, presence and system scale issues omitted. With directories however, if one is placing information into a common repository for many applications and users, then its information (and identity) design and schema must be developed around what the objects are representing in real life. In most cases, these objects represent users, address books, rosters, preferences, entitlements, products and services, devices, profiles, policies, telephone numbers, routing information, etc. In addition one must also consider the operational aspects of design in regard to performance and scale. A quick check on the operational design is to take eg. 1 million users, 50 objects each with users or applications accessing these objects up to 5000 times a second, minute, or hour (to authorize and update their service environments), and check if the server and network machinery considered can support this. The major difference with databases and directories is at the system level where a database is used to automate a process with a dedicated (relational) data model, but a directory is used to hold "identified" objects that can be used by many applications in random ways. A Directory service is applied where "multi governance" (many applications and users) are, for integrity and efficiency reasons, using the same information. This approach to system design gives greater scale and flexibility so that the larger scale functions such as [[Service Delivery Platform]]s can be specified correctly. SDPs now need to support 100s of millions of objects (HSS/HLR, address books, user entitlements, VOIP telephone numbers, user and device information, etc) in real time, random ways and be managed from BSS/OSS/CRM type systems as well as the customer self care applications. Symptomatic of database designs is that the larger companies have hundreds (if not thousands) of them for different processes and are now trying to converge their user and service identity information and their online goods and services management, and deliver these in real time, cost effectively. So a large scale directory service should be in their solution architecture. == Implementations of directory services == Directory services were part of an [[Open Systems Interconnection]] (OSI) initiative to get everyone in the industry to agree to common network standards to provide multi-vendor interoperability. In the 1980s the [[International Telecommunication Union|ITU]] and [[International Organization for Standardization|ISO]] came up with a set of standards - [[X.500]], for directory services, initially to support the requirements of inter-carrier electronic messaging and network name lookup. The Lightweight Directory Access Protocol, [[Lightweight Directory Access Protocol|LDAP]], is based on the directory information services of [[X.500]], but uses the [[Internet protocol suite|TCP/IP stack]] and a string encoding scheme of the [[X.500]] protocol DAP, giving it more relevance on the [[Internet]]. There have been numerous forms of directory service implementations from different vendors. Systems developed before the advent of X.500 include: * '''DNS:''' The [[Domain Name System]] (DNS), the first directory service on the Internet, which is still used everywhere today. * '''Hesiod:''' The [[Hesiod (name service)]], based on DNS and used at MIT's [[Project Athena]]. * '''NIS:''' The [[Network Information Service]] (NIS) protocol, originally named [[Yellow Pages (computing)|Yellow Pages]] (YP), was [[Sun Microsystems]]' implementation of a directory service for [[Unix]] network environments. It served a similar role as Hesiod. Among the LDAP/X.500 based implementations are: * '''[[Novell eDirectory|eDirectory:]]''' This is [[Novell]]'s implementation of directory services. It supports multiple architectures including [[Microsoft Windows|Windows]], [[NetWare]], [[Linux]] and several flavours of [[Unix]] and has long been used for user administration, configuration management, and software management. eDirectory has evolved into a central component in a broader range of [[Identity management]] products. It was previously known as Novell Directory Services. * '''Red Hat Directory Server:''' [[Red Hat]] released a directory service, that it acquired from AOL's '''Netscape Security Solutions''' unit[http://www.informationweek.com/story/showArticle.jhtml?articleID=48800390], as a commercial product running on top of [[Red Hat Enterprise Linux]] called Red Hat Directory Server and as part of [[Fedora Core]] called [[Fedora Directory Server]]. * '''[[Active Directory]]:''' [[Microsoft]]'s directory service is the Active Directory which is included in the [[Windows 2000]] and [[Windows Server 2003]] operating system versions. * '''Open Directory:''' [[Apple Computer|Apple's]] [[Mac OS X Server]] offers a directory service called [[Apple Open Directory|Open Directory]] which integrates with many open standard protocols such as [[Lightweight Directory Access Protocol|LDAP]] and Kerberos as well as proprietary directory solutions like Active Directory and eDirectory. It is a customized build of [[OpenLDAP]]. * '''Apache Directory Server:''' [[Apache Software Foundation]] offers a directory service called [[Apache Directory Server|ApacheDS]]. * '''Oracle Internet Directory:''' (OID) is [[Oracle Corporation]]'s directory service, which is compatible with LDAP version 3. * '''CA Directory:''' CA Directory contains pre-caching engine which can index all attributes that are used in LDAP search filters, and caching all attributes returned in search results. * '''[[Sun Java System Directory Server]]:''' [[Sun Microsystems]]' current directory service offering, found at [http://www.sun.com/software/products/directory_srvr_ee/]. * '''[[OpenDS]]:''' An open source directory service implementation from scratch in Java, backed by [[Sun Microsystems]] and hosted at [http://opends.dev.java.net/]. * '''[[Banyan VINES]]:''' - The first scalable directory services offering. * '''[[IBM Tivoli Directory Server]]''' It is a customized build of an old release of [[OpenLDAP]]. * '''[[Siemens DirX Directory Server]]''' * '''Windows [[NT Directory Service]]s (NTDS)''' * '''Critical Path Directory Server''' * '''[[OpenLDAP]]''' Derived from the original University of Michigan reference LDAP implementation (as are the Netscape/Red Hat/Fedora/Sun JSDS servers) but significantly evolved. It supports all current computer architectures, including Unix and Unix derivatives, Linux, Windows, z/OS, and a variety of embedded/realtime systems. * '''[[Isode Limited]]:''' High performance and high availability LDAP and X.500 servers. There are also plenty of [[open-source]] tools to create directory services, including [[OpenLDAP]] and the [[Kerberos (protocol)|Kerberos protocol]], and [[Samba software]] which can act as a Windows Domain Controller with [[Kerberos (protocol)|Kerberos]] and LDAP backends. == Notes == <div class="references-small"> <references /> </div> == See also == * [[Domain name system]] * [[LDAP Data Interchange Format]] * [[Directory Service Markup Language]] == References == * {{cite book |last= Carter |first= Gerald |authorlink= |coauthors= |title= LDAP System Administration |year= 2003 |publisher= [[O'Reilly Media]] |location= |isbn= 978-1-56592-491-8 }} == External links == * [http://ldap.artzweb.net/ Directory Technology Review] - An investigation into the use of directories for developing a management application which can manage both data and network services, specifically for the web hosting industry. *[http://www.engnetglobal.com/ EngNet Engineering Directory] Online Directory categorized by products and services within engineering and industry disciplines [[Category:Identity management]] [[de:Verzeichnisdienst]] [[es:Servicio de directorio]] [[fa:دایرکتوری سرویس]] [[fr:Annuaire]] [[ko:디렉터리 서비스]] [[it:Servizio di directory]] [[he:Directory service]] [[ja:ディレクトリ・サービス]] [[pl:Usługa katalogowa]] [[pt:Serviço de diretório]] [[ru:Служба каталогов]]