Some experiences on LDAP deployment in the RedIRIS network TF-LSD February 2, 2001. Amsterdam

Evolution of the Spanish Academic Directory From X.500 to LDAP From X.521 to dc-based Current o=Universidad XX,c=es Intended dc=uxx,dc=es Simpler location of electronic entities Domain-based naming is used by all other services Ease of use (user@dom.ain, server.dom.ain) Easier integration with the SRV RR in DNS Problems White-pages applications It is usual to reflect organization structures into the DIT Searches are often performed on DN components. Those attributes are not included in the entry itself Legacy (what about certificates?)

From X.521 to dc naming Legacy White pages Temporary maintenance of both structures Up to what existing applications require White pages CIP-based index server (LIMS) Minimum common set of attributes (iris-* classes?) At the national level (dc=es/c=es), a server containing referrals to organizational servers At the organizational level, recommendations for building interfaces based on the iris-* attributes

Migration Task Force RedIRIS + 3 universities + 1 regional government 6 LDAP servers 40,000 entries Definition of a iris-* skeleton Define required (indexable) attributes for: Organizations Groups Services Persons Attributes for metadata are specially relevant Tests on the new structure Migration guide

o=universidad de la rioja, c=es Test structure referral dc=xx OpenLDAP dc=es OpenLDAP dc=rediris dc=rediris, dc=es OpenLDAP dc=um dc=um, dc=es OpenLDAP dc=dif dc=dif, dc=um, dc=es dc=unirioja c=es Netscape Directory Server o=rediris o=universidad de la rioja, c=es o=universidad de la rioja IPlanet o=GVA o=GVA, c=es

Experimental index server

Tests with the index server Using the LDIF files provided by the participating organizations Experiments are quite promising Issues detected up to now Different formats for coding national characters in LDIF files => problems when searching them Mismatch between the speficied filter and the one used internally by the index server Assume we use the filter cn=javi The index server returns referrals for the filter cn=*javi* Not all referred servers contains entries matching cn=javi, so they return “not found” when receiving the search