innosoft international inc. Ó 1999 Innosoft International, Inc. Using LDAPv3 for Directory-Enabled Applications & Networking Greg Lavender Director of Technology Innosoft International, Inc.

innosoft international inc. Ó 1999 Innosoft International, Inc. An LDAP-enabled Enterprise Directory Infrastructure Existing DBMS Intranet services Unified login services Applications Legacy Directories System Mgmt DNS, DHCP, SLP NDS, Notes, X.500 HR, Facilities, etc.Mail, web, chat, etc. Telecomm, Workflow, etc. X.509, SSO, PAM, NTDC LDAP-enabled Enterprise Directory Backbone (multiple distributed LDAP servers) PKI sync VPN Routers, Firewalls, RAS Devices

innosoft international inc. Ó 1999 Innosoft International, Inc. How to Get There Top-down – identify authoritative directory data sources export and load data into an LDAP directory – periodic or on-change synchronization to get updates – eventually you might make the directory authoritative – incrementally deploy LDAP-enabled user applications easiest is a white pages directory for web or requires you to set security and access control policies eventually allow users to update their own information

innosoft international inc. Ó 1999 Innosoft International, Inc. How to Get There Bottom-up – LDAP-enable the network application infrastructure web server authentication remote access authentication (e.g., RADIUS) firewall user authentication POP and IMAP mail authentication host and IP address management policy based routing and VPN security directory in support of public-key authentication

innosoft international inc. Ó 1999 Innosoft International, Inc. Example Applications Enterprise whitepages directory Enterprise network services directory ISP high volume messaging Voice-over-IP use of directory

innosoft international inc. Ó 1999 Innosoft International, Inc. LDAP Enterprise Whitepages Directory Sun Console UltraSPARC 2 Solaris 2.6 Veritas FS 1 x 300 MHz processor 512 MB memory 2 x 4 GB storage (primary) Sun E3000 Solaris 2.6 Veritas FS 2 x 336 MHz processors 2 GB memory 2 x 4 GB storage (primary) high availability heartbeat (Ethernet) 2 x 4 GB storage (mirror) 2 x 4 GB storage (mirror) Sun UltraSCSI Disk Array Innosoft Server 4 x 9 GB storage (primary) Hub Enterprise Web Users Web ServersHigh Availability 24x7 LDAP Directory Service Directory Manager Enterprise Mail Users LDAP HTTP LDAP HTTP SNMP

innosoft international inc. Ó 1999 Innosoft International, Inc. Enterprise Network Services with LDAP Proxy & Replicated Servers Extranet/ Internet Replicated LDAP Servers LDAP Proxy SMTP/POP/IMAP HTTP Mail Server Web Server LDAP access for user authentication LDAP access for user authentication, mail routing, and delivery options access control load balancing & failover LDAP

innosoft international inc. Ó 1999 Innosoft International, Inc. High Volume ISP Mail Services with Replicated LDAP Servers Internet Master LDAP Server SMTP/POP/IMAP Multiple boundary SMTP relays with local LDAP replica for high performance user authentication and mail routing LDAP Replication

innosoft international inc. Ó 1999 Innosoft International, Inc. LDAP Directory in a VoIP System Call Processing Server LDAP server used as a routing and subscriber authentication database Phones VoIP Network Each CPS caches routing table and sets an LDAP “search trigger” to be notified in the event of a route update When routing update occurs, LDAP search trigger fires and asynchronously updates each CPS LDAP Directory Server

innosoft international inc. Ó 1999 Innosoft International, Inc. Key Considerations Performance and scalability – 500+ queries/sec with 1 CPU, millions of directory entries Replication for high availability – multiple slaves AND multiple masters for high availability Security and access control – SSLv3 for authentication and encryption – LDAP firewall proxy as front-line of defense Load balancing and failover – proxy server to distribute queries and detect failures

innosoft international inc. Ó 1999 Innosoft International, Inc. High Availability Directories have become mission critical – users get used to accessing data 24x7 – critical applications require 100% availability Option 1: provide HA with expensive hardware – centralize data and provide hardware fault tolerance Option 2: provide HA with lower cost hardware – distribute and replicate data for high availability – provide failover and load balancing

innosoft international inc. Ó 1999 Innosoft International, Inc. High Availability LDAP Services Put authoritative information close to users No single point of failure (multiple masters) Deal with failure transparently Distribute work load for efficiency All of the above lead to 24x7 availability

innosoft international inc. Ó 1999 Innosoft International, Inc. Fallback Multi-Master Replication Uses LDAPv3 – weakly consistent replication based on “anti-entropy” protocol concepts reduced bandwidth demands Primary and secondary master servers – masters coordinate to remain consistent – multiple slaves for scalability and fast response time – “second-level slaves” to support replication hierarchies

innosoft international inc. Ó 1999 Innosoft International, Inc. A HA LDAP Server Scenario Primary MasterFallback Master Replicated Slaves Secondary Slave Updates Incremental Update Propagation Updates Referral synchronization

innosoft international inc. Ó 1999 Innosoft International, Inc. LDAP Proxy Server A secure “chaining” LDAP server – configurable query filtering for security blocks denial-of-service attacks stops “trawling” – filters connections, search requests access control groups can rewrite search requests/results – transparently forwards operations to one or more servers – does automatic failover

innosoft international inc. Ó 1999 Innosoft International, Inc. Load Balancing/Failover LDAP Proxy Servers Master or Slave Servers Searches or Updates Forward Operations to a Server in a Server Group LDAP proxy server monitors directory servers for load and balances operations across masters or slaves in a server group. Also applies coarse grained access control Load Balancing

innosoft international inc. Ó 1999 Innosoft International, Inc. Transparent Failover Load Balancing/Failover Proxy Servers Masters or Slaves Searches or Updates Forward Operations to a Server in a Server Group Proxy server monitors directory servers and detects server failure and redirects operations until recovery