1. Information Technology Registry Services Security LDAP-based Attributes and Authentication

2. Information Technology 6/1/20152 Presentation Goals Describe –The Registry –Its use for authentication –Its use for attribute information –Security of Registry information

3. Information Technology 6/1/20153 The Registry A database exposed through LDAP protocols Populated from both authoritative and other sources Failure-tolerant architecture Looks like a directory with more data items But it’s NOT the “white pages”

4. Information Technology 6/1/20154 What Data Items? Names, addresses, phone numbers Affiliations, positions, locations, groups E-mail routing Passwords and certificates Entitlements Optional information Standards-based items

5. Information Technology 6/1/20155 LDAP Cluster SESHRIS Load balancing Load balancing Replication registry.northwestern.edudirectory.northwestern.edu IT Computing Services Extraction Replication SNAP RegistryWhite Pages Note: schematic – not an engineering representation

6. Information Technology 6/1/20156 Access to Data Items Access is controlled in four ways: –Anonymous bind to registry is reserved to known e-mail hosts –User binding restricted by IP address –Attribute retrieval protected by application credentialing and Access Control Lists –White pages is an extract of registry data

7. Information Technology 6/1/20157 Anonymous Binding Appropriate for white pages lookup Fast – no encryption Program binds, then queries by indexed attribute Return is defined by ACL Eudora Outlook Relay LDAP Service ??

8. Information Technology 6/1/20158 User Binding The only means to check username and password validity Restricted by IP address to avoid brute-force attacks Encrypted via SSL Will eventually be isolated from the application by SSO Return is defined by ACL SES SNAP Hecky LDAP Service

9. Information Technology 6/1/20159 Attribute Retrieval Binding Application presents assigned credentials to bind as itself Queries and receives return defined by unique ACL Encrypted via SSL Ex: from NetID get DN NUTV VPN Course Mgmt LDAP Service

10. Information Technology 6/1/201510 IP Address Restrictions Restriction of LDAP protocols by IP address is performed by ITCS firewall Request-specific ACL limits exposure of data items ACLs Registry Data LDAP Registry

11. Information Technology 6/1/201511 Use of Bindings Anonymous binding is used by e-mail clients Access to Registry is strictly controlled Passwords and private attributes are protected via SSL RegistryDirectory AnonymousRestricted by IP address Governed by privacy rules User (SSL)Restricted by IP address Not Permitted Application (SSL) Credentials required Directory Web page only Bindings

12. Information Technology 6/1/201512 Typical Three-Step Scenario Binding with DN and password is IP-restricted and isolated from application coding Binding as an application presents credentials defining returned attributes LDAP Plug-in Web Server LDAP Plug-in Application Server Registry 3. Bind as application Key: NetID Return: attributes Transaction data including NetID 1.Bind as web server, search by NetID for DN, then 2.Bind by DN to validate password (SSL)

13. Information Technology 6/1/201513 White Pages is a Separate Service White pages (directory.northwestern.edu) is a separate service on separate hardware: –To increase performance –To separate the Registry for better security –To expose only the relevant data items to potential compromise

14. Information Technology 6/1/201514 How is Registry Access Governed? Due to the protections in place, access must be requested through NUIT. Requests must be approved by the custodian(s) of the data. NUIT then assigns the appropriate ACL to restrict access to only the approved data items.

15. Information Technology 6/1/201515 How are Data Items Selected? Registry data items fall into categories: –Those entrusted by SES and HRIS –Those necessary for e-mail routing and selective access to network services as defined by NUIT –Those historically available in the white pages

16. Information Technology 6/1/201516 New Data Items Requests to include new items must be reviewed by NUIT and the source Additional reviews by administrative offices may be required New data items are not automatically exposed to existing ACLs