Data Virtualization Tutorial… LDAP Domains in CIS Hello, and welcome to the Tutorial series for Cisco Information Server, or CIS. Tutorials are brief instructional videos that demonstrate specific features of CIS In this tutorial, we discuss the use of LDAP domains in CIS.

For more details… Resources: Additional information: Archives Documentation Training Resources: Archives Data files Tutorial Document Note that Tutorials are NOT meant to be comprehensive training modules. Instead, they demonstrate a very basic use case that can be built quickly and easily. However, the Data Virtualization Knowledge Base contains additional information that will help you learn more and go deeper. Additional resources in the Knowledge Base include: <CLICK> Resources used to build the tutorial, such as Data Virtualization Archive files, data source files, and a document version of this tutorial… <CLICK> … and additional information, including documentation and training materials.

Agenda What are they and why do they matter? A basic demo Summary Here is our agenda. We begin by defining CIS LDAP Domains and outlining their importance for our customers. Next we walk through a very basic demo of using a CIS LDAP domain to define Groups and Users. Finally, we summarize the contents of this tutorial.

Agenda What are they and why do they matter? A basic demo Summary Let’s begin by defining CIS LDAP Domains and examining their importance for data virtualization.

What are they? CIS Domains are used to: Define Groups and Users Assign Rights There are three types of CIS Domains: Composite Dynamic LDAP CIS Domains are containers for defining, and assigning Rights, to CIS Groups and Users. CIS Supports three types of domains: The Composite domain is for groups and users that are completely managed within the CIS product suite. There is one and only one Composite domain within a CIS instance. The Dynamic domain is for pass-through authentication to underlying physical data sources. There may be at most one Dynamic domain within a CIS instance. LDAP domains within CIS interface with existing enterprise deployments of Lightweight Directory Access Protocol products, such as Active Directory, eDirectory, or iPlanet. There may be zero, one, or many LDAP domains within a CIS instance.

Why do they matter? LDAP Domains Leverage existing enterprise security infrastructure Avoid duplication of effort by administrators Ensure consistency as groups and users change over time LDAP Domains are important to enterprise customers because they enable CIS to leverage existing security policy that is embodied in their LDAP deployments. This means that system administrators can define users and groups once in their LDAP systems, and do not have to perform extra work to define these users and groups in CIS. This ensures that CIS will remain consistent with enterprise security policies as Groups and Users change over time.

Agenda What are they and why do they matter? A basic demo Summary Next, let’s walk through a very basic demo of LDAP domains in CIS.

Demo: Here is the business problem… Here is the business problem we illustrate in this tutorial.

Demo: Here is the business problem… CIS Composite Domain Administrators Group This enterprise wants a small group of CIS administrators to be managed directly through the CIS Composite domain.

Demo: Here is the business problem… CIS Composite Domain Administrators Group Dev Group Analyst Group Active Directory CIS LDAP Domain However, we want all other users, including developers, analysts, and sales people, to be managed within Microsoft’s Active Directory, which provides a single point of management for all of their enterprise authentication needs. CIS will leverage this Active Directory infrastructure, and automatically adapt as users come and go from Active Directory. Sales Group

Demo: before you begin… Install and configure an LDAP Browser Whenever you work with LDAP and CIS, you may find it useful to have an LDAP browser utility handy. <CLICK> The Softerra LDAP Browser shown here is a free download, and works quite well. <CLICK> It will help you understand the schema and contents of any particular LDAP instance. <CLICK> It will also help you build the exact URL you will need to specify in CIS… <CLICK> … and help you verify that your credentials are accurate and properly formatted.

Demo: before you begin… Verify connectivity to LDAP An LDAP browser, such as the Softerra browser shown here, allows us to test connectivity to our LDAP directory before we try to configure CIS. It also helps us understand the structure of the LDAP directory, so we can verify that our ldap.properties file has been configured correctly. To connect to an LDAP directory, we begin by right-clicking the top of the namespace tree and selecting New Profile. <CLICK> We provide a name for the profile… <CLICK> … and then specify the host and port. Once we have specified the host and port, we can click the “Fetch Base DNs” button to populate a drop-down list of available entry points to the directory schema. DN stands for “distinguished name,” which is a unique identifier in LDAP. In this example, our data exists in an Active Directory application partition with a Distinguished Name of Organization equals DemoCorp, Country equals US, as shown here. <CLICK> Now we specify the id and password. Click “Save password” to make subsequent access easier. <CLICK> The LDAP data is now available to us.

Demo: before you begin… Configure the ldap.properties file in CIS Before you connect CIS to an LDAP Server, you must supply a properly-configured ldap.properties file. This provides details about the specific schema of the LDAP instance you are integrating. <CLICK> This file must be placed in the directory shown here.

Demo: Set the stage CIS reads LDAP, but never writes Initial synchronization downloads selected LDAP groups to CIS Group Rights and Privileges are assigned in CIS Individual Users are not created in CIS until their initial login CIS uses the LDAP server to authenticate at login time Before we begin, , let’s level-set on some of the technical underpinnings of LDAP domains in CIS. First of all, it is important to understand that CIS READS the LDAP repository but never WRITES to it. This is an important requirement for LDAP administrators. When we first define the LDAP domain, CIS will download LDAP Groups that are specified in our ldap.properties file. If Groups are added and deleted frequently, we may want to re-synchronize from time to time. It is not necessary to re-synchronize as users are added and deleted. Once our Groups are downloaded, we will assign them Rights and Privileges within CIS. We use LDAP for Authentication, but Authorization is still determined within CIS. This is appropriate because authorization controls are very specific to Data Virtualization resources, and LDAP has no knowledge of these resources, which include Views, Procedures, Transformations, and so on. Although we have created Groups, no users will be created in CIS until they actually attempt to log in to CIS. At login time, CIS asks the LDAP server to authenticate the user. This demo uses simple password-based authentication, but Kerberos authentication may also be implemented. If the authentication is successful, and if this is the user’s first login, CIS will then create the user and assign it to the Groups to which it belongs.

Demo: Explore and explain the LDAP content As our LDAP browser shows, for this particular LDAP deployment, our CIS users reside in three different Organizational Units: Development, Eagle, and Sales.

Demo: Explore and explain the LDAP content These containers are defined by default as part of the Active Directory installation, and contain no data.

Demo: Explore and explain the LDAP content Within each Organizational Unit, we have defined users…

Demo: Explore and explain the LDAP content … and groups.

Demo: Explore and explain the LDAP content Within each group, we have also defined users as members of the group.

Demo: Explore and explain the LDAP content The Roles container is also installed by default, and contains various containers for administrative roles. Note that we have also defined a user named CISReader. This user has been assigned to the group named Readers, which means it can read data from Active Directory, but cannot make any changes. We will use CISReader as the user that CIS Manager employs to read data from Active Directory.

Demo: Explore and explain the ldap.properties file Section 1: Define query for all users We will query these containers We only want user objects Now that we understand the structure of our specific LDAP directory, let’s see how the CIS ldap.properties file has been configured to use this directory. The properties file contains four sections. Section one defines the query parameters that CIS will use to find all users. <CLICK> We specify that CIS should search three Organizational Unit containers… Sales, Development, and Eagle. <CLICK> We specify that we are only interested in User objects. <CLICK> An LDAP user may have many attributes. We choose the uid attribute as the one that will be used as the CIS login. You may choose any attribute that your organization wishes to use as the CIS User ID. <CLICK> We specify no timeout period for the query. No timeout value is specified The CIS Login will be taken from this LDAP user attribute

Demo: Explore and explain the ldap.properties file Section 2: Define query for all groups We will query these containers We only want group objects Section two defines the query parameters that CIS will use to find all groups. <CLICK> We specify that CIS should search three Organizational Unit containers… Sales, Development, and Eagle. <CLICK> We specify that we are only interested in Group objects. <CLICK> An LDAP group may have many attributes. We choose the cn, or Common Name attribute as the one that will be used as the CIS group name. <CLICK> We specify no timeout period for the query. No timeout value is specified The CIS group name will be taken from this LDAP group attribute

Demo: Explore and explain the ldap.properties file Section 3: Define user authentication parameters We will do a case-sensitive lookup We will look in these containers Section three defines the parameters that CIS will use to authenticate a user at login time. <CLICK> We specify a case-sensitive lookup. <CLICK> We specify that CIS should search three Organizational Unit containers… Sales, Development, and Eagle. <CLICK> We specify that we are looking for a User object… <CLICK> …with a uid attribute that matches the CIS login. <CLICK> Once we find a match, we specify that the uid attribute is the data we want returned to CIS. <CLICK> We specify a timeout period of 1,000 milliseconds. We specify a timeout value of 1,000 milliseconds We only want user objects The CIS Login will be matched to this LDAP user attribute

Demo: Explore and explain the ldap.properties file Section 4: Find all of a user’s LDAP group memberships We will look in these containers We will look for group objects We specify a timeout value of 1,000 milliseconds The LDAP group names are in this group attribute Section four defines the parameters that CIS will use to find all of a user’s LDAP group memberships. <CLICK> We specify that CIS should search three Organizational Unit containers… Sales, Development, and Eagle. <CLICK> We specify that we are looking for Group objects… <CLICK> …that have a member with the Distinguished Name that will be passed by CIS. <CLICK> The Group Name we want returned to CIS resides in the LDAP cn, or Common Name attribute. <CLICK> We specify a timeout period of 1,000 milliseconds.

Demo: Create the LDAP Domain in CIS Now we are ready to create the LDAP domain in CIS. <CLICK> We log in to CIS Manager, and select Domain Management from the Users tab… <CLICK> …then click Add Domain. <CLICK> We fill in the required information. <CLICK> To find the exact URL we need, we can look at the connection properties from our LDAP browser. The URL is found on the Profile tab… <CLICK> … and the Login name is found on the credentials tab.

Demo: Create the LDAP Domain in CIS When we click OK, the LDAP domain is created.

Demo: Assign rights to a group Now we can add groups to the domain. We select the domain, and click “Edit External Groups.” <CLICK> We select all the groups, and click OK.

Demo: Assign rights to a group Now we can assign Rights to a group. We navigate to Group Management… <CLICK> …choose the Architects group, and click Edit Group. <CLICK> We’ll give the Architects Rights from the Developer template, which allows them to access Studio.

Demo: Assign rights to a group Our Architects group now has Rights assigned to it. <CLICK> However, the group still has no users. That’s because CIS does not create a user from an LDAP group until that user actually logs in for the first time.

Demo: Log in as a group member Let’s log in as a member of the Architects group, Archie Architect. We use the uid attribute from LDAP as the user name, and enter the password. We specify ldap-demo as the domain. <CLICK> We log in, and see that Archie has access to the Shared folder, and a blank My Home folder because he is a new user. If you get an error message at login time, and you are on a slow network connection, you may want to adjust the timeout period in the ldap.properties file.

Demo: Log in as a group member When we go to User Management in CIS Manager, we can see that Archie is now defined as a user. <CLICK> He is a member of the Architects group, as well as the All group. Our demo is complete.

Agenda What are they and why do they matter? A basic demo Summary Let’s review what we have seen in this tutorial.

Summary There are three types of CIS Domains: Composite Dynamic LDAP LDAP Domains Leverage existing enterprise security infrastructure Avoid duplication of effort by administrators Ensure consistency as groups and users change over time CIS Domains are containers for defining, and assigning Rights, to CIS Groups and Users. CIS Supports three types of domains: The Composite domain is for groups and users that are completely managed within the CIS product suite. There is one and only one Composite domain within a CIS instance. The Dynamic domain is for pass-through authentication to underlying physical data sources. There may be at most one Dynamic domain within a CIS instance. LDAP domains within CIS interface with existing enterprise deployments of Lightweight Directory Access Protocol products, such as Active Directory, eDirectory, or iPlanet. There may be zero, one, or many LDAP domains within a CIS instance. LDAP Domains are important to enterprise customers because they enable CIS to leverage existing security policy that is embodied in their LDAP deployments. This means that system administrators can define users and groups once in their LDAP systems, and do not have to perform extra work to define these users and groups in CIS. This ensures that CIS will remain consistent with enterprise security policies as Groups and Users change over time. Thank you.

TOMORROW starts here.