Virtual Directory Services and Directory Synchronization May 13 th, 2008 Bill Claycomb Computer Systems Analyst Infrastructure Computing Systems Department Sandia is a multiprogram laboratory operated by Sandia Corporation, a Lockheed Martin Company, for the United States Department of Energy’s National Nuclear Security Administration under contract DE-AC04-94AL85000.

Introduction Challenges and Solutions Future work Questions Agenda

Introduction What are directory information services? –What data do they contain? –Who wants that data? –Why must it be protected? –How do we protect it? What are virtual directories? What is directory synchronization?

Directory Information Services Provide user data to applications –Web portals –Instant Messaging –Single-sign-on – May contain personally identifiable information Come in several different flavors –LDAP Active Directory SunOne –Databases SQL

Virtual Directories “Virtual” – the directory doesn’t actually exist Tailor data to specific needs Collect data from different data sources

Virtual Directory Server

Virtual Directories

Directory Synchronization Reflect data from one source to another Used for various purposes –Account provisioning –Application specific needs –Performance Improvement

Synchronization

Challenges Limiting the amount of data provided Limiting who has access to the data Providing data from one data source as another type of data source Provisioning accounts Combining data from disparate data sources Collecting data from remote data sources Keeping data up-to-date

Challenge: Limit the data provided Example: –An application which only requires name and address Solution: –Configure a virtual directory to supply a subset of the total attributes available

Challenge: Limit who has access to the data Examples: –An external facing employee directory server –Data access restricted to U.S. Citizens i.e. Export Controlled Software Solution: –Use a virtual directory to reflect data from one environment to another –Use virtual directory authorization to specify access control

Challenge: Provide data from one source to another Example: –Technical Library needed information from an LDAP server –Information is only contained in a SQL database Solution: –Use a virtual directory to provide SQL information as LDAP information

Challenge: Account Provisioning Example: –Authorized account information is contained in multiple SQL databases –Accounts are stored in an LDAP directory Solution: –Use a virtual directory to create a complete view of account information –Use directory synchronization to provision new accounts according to that data

Challenge: Collect data from disparate data sources Example: –User information comes from both directories and databases Solution: –Use virtual directories to correlate and present data from multiple data sources

Challenge: Collect data from remote data sources Example: –Directory information from remote sites is needed for a local address book Solution: –Use directory synchronization to pull data from remote LDAP servers and populate it in a local LDAP store

Challenge: Keeping Data up-to-date Example: –External contact information, stored in a database, is needed in an LDAP directory Solution –Use directory synchronization to reflect database changes in the destination directory

Solution: Details Virtual Directory Services and Synchronization available on internal networks Can be ported to externally available sources Implemented by RadiantOne, from Radiant Logic, Inc.

Future Work Exploring additional security features Bringing additional data sources together

Questions