Novell Virtual Directory Services

Roger Harrison

Senior Manager, Identity Provider Services Engineering

Novell, Inc.

Tim Larsen

Software Engineer, Identity Provider Services Engineering

Novell, Inc.

Agenda

Why NVDS?

NVDS Overview

Schema

Administrative Points

Role Activation and Deactivation

Defining New Administrative Types

Developing to NVDS

Novell Virtual Directory Services

Gives your application

Its own directory-style private data store

Ability to store some identity attributes locally while connecting to an existing corporate directory for authentication and authorization

Ability to support multiple identity stores

Novell eDirectory™

Microsoft Active Directory

Sun Java System Directory Server

Allows your customers to

Focus on your application's core value proposition

Avoid political and technical deployment hurdles

Why NVDS?

Use Case One

You have an opportunity to sell your directory-enabled application into a single department at a Fortune 500 company that is already using eDirectory™ as its corporate directory.

Problem: Extending the schema for your application in the corporate tree requires corporate-level approval. Furthermore, your application adds attributes to the User object, and corporate IS&T is complaining about it. This has already delayed the sale by two months, and it looks like it will be at least two more months before approval is obtained to deploy the application for this department.

Use Case Two

You want to sell your directory-enabled application into Active Directory shops.

Problem: Customers in these shops are already using Active Directory and don’t want to deploy eDirectory. To make matters worse, you’ll also require them to install DirXML® drivers between Active Directory and eDirectory to make the application work. Potential customers are asking why your application cannot just use the identities in Active Directory for authentication and authorization decisions without having to install a meta-directory product to bring your product's data and the user identities into a single directory.

Use Case Three

Your product manager tells you that your directory-enabled application has to provide policy and authorization decisions for users and other identities stored in all of the following corporate directories: eDirectory, Sun Java System Directory Server, and Active Directory.

Problem: Your application also needs a place to store its own configuration and policy information. The directory seems like a perfect place to store it, but the application won’t be widely adopted unless it works without making any updates to the corporate directory.

NVDS Overview

Novell Virtual Directory Services

Gives your application

Its own directory-style private data store

Ability to store some identity attributes locally while connecting to an existing corporate directory for authentication and authorization

Ability to support multiple identity stores

Novell eDirectory™

Microsoft Active Directory

Sun Java System Directory Server

Allows your customers to

Focus on your application's core value proposition

Avoid political and technical deployment hurdles

Private Directory Vision

Give applications a private data store that offers the power, flexibility, and features of a directory service without requiring installation of a corporate directory or updates to that directory’s schema, etc.

Identity Integration Vision

Give applications the ability to seamlessly integrate with a customer's corporate directory infrastructure and the information—typically identity information—it stores.

Management Vision

Application vendors have the freedom of choice on how their applications will be managed. All management tools are exposed natively via Novell's management framework or through API's that enable vendors to write their own.

Customer Usage Vision

Customer installs, configures, manages, uses, and even uninstalls an application that embeds NVDS and never sees NVDS

NVDS

An Application's View of NVDS

End user of the application that has Novell Virtual Directory Services

Chaining to other directories

NVDS

Request

Result

Request

Result

Result

Request

Request

Result

Directory

Directory

Directory

Other corporate directories

Application

NVDS Architecture

Service

Registry

Common

Directory Agent

Local

Directory

Agent

Other

Chaining

Agents

LDAP

Chaining

Agent

Foundation

Services

Authorization &

Authentication

Services

Other

Protocol

Handlers

SOAP

Protocol

Handlers

LDAP

Protocol

Handler

Local Store

Novell Virtual Directory Services

Deployment Services

Administration Services

Directory Services

Security Services

OS Support

Deployment Services

Silent and Scriptable Installation

An embedding application installs NVDS without requiring the end user to run a separate installation program

All NVDS installation parameters can be provided via a parameter file

The NVDS installation runs silently

Multiple Instance

Multiple instances of NVDS can run on a single machine

These instances operate independent of one another

Implementation

Install Anywhere (Windows and NetWare)

RPM-based (Linux)

Administrative Services
iManager Content

Entry creation, modification, and deletion

Object-class-specific plug-ins for users, groups and OU's

Generic object browser and editor

System Configuration

iManager role and task management

Identity integration wizard

Password and login policies

Protocol handler and chaining agent configuration

Database configuration

Administrative Services
iManager Content

System management and maintenance

Certificate provisioning and management

Backup/Restore

Check/Repair

Administrative Services
iManager Content

Diagnostics and statistics

Low level DIB browse

Schema browse

Trace

System stats and info

Active inbound and outbound sessions

Modules with their associated services and events

Scheduler stats

Administrative Services
Command Line

Novell Import Conversion Export (ICE) utility

Modify the NVDS DIB via a command line or script.

Create, modify, and delete entries via LDIF

Includes the ability to define and extend schema

Export entries to LDIF

Command line administration

Perform SOAP-based administration operations using web services command line client

Administrative Services

Management

NVDS

NVDS

Web Services

SDK

iManager

Custom

Management

Command Line

Client

Administrative Services

Administration via LDAP and SOAP

Product will have the ability to be administered via standard LDAP and SOAP calls, thus not requiring an embedding application to use iManager for administration.

No private administrative APIs

Entry creation, modification, deletion and retrieval via LDAP

Other management, maintenance and diagnostic operations performed via SOAP

Directory Services

LDAP v3 compliant

As defined by the Open Group

Enhanced schema and object model capabilities

Removed limitations of eDirectory

Administrative areas

Store administrative entries

Schema and other definitions as normal entries

Administrative points and subentries

No obituaries

Directory Services

Enhanced Identity Datastore

XFLAIM

Supports the ability to decompose and then store XML documents as native elements of the database manager

Provides the ability to index individual XML document elements such as attributes and nodes

Directory Services

Encrypted Attributes

Specific attributes can be defined (via schema) to encrypt values while stored in the Identity Datastore

Policies can be used to ensure secure transmission of encrypted attribute types

Replication

State based replication of updates to local entries between NVDS servers that share replication agreements

The replication agreement administrative area is the entire set of entries on a single NVDS server

Security Services

Module authentication

NVDS modules will be able to securely perform privileged operations

Client authentication

Name and password

Other authentication methods in future

Security Services

Remote authentication to external directories

Currently established identity

Proxy identity

Supported directories

Active Directory

eDirectory

Sun Java System Directory Server

Novell Virtual Directory Services

Security Services

Access Control

ACLs

Can be stored on any entry

Can be managed by container or group

Automatically inherited unless explicitly blocked

Roles and automatic role activation

SSL/TLS based data transmission

Provides data confidentiality and integrity services

Available for all data transmission

Inbound connections from clients

Outbound connections to identity stores

Connections used for replication

Security Services

Policy

Password value policies

minimum length

minimum number upper/lower case characters

minimum number of numeric characters

minimum number of special characters

disallow entry name in password

Security Services

Policy

Login policies

number failed attempts allowed

duration of intruder detection lock

time to delay before returning login failure

Account lockout policy

Disable account

Chaining policy

OS Support

Linux

SLES 9

RedHat AS 3.0

Windows 2003 Server

NetWare 6.5

Schema

NVDS Schema Overview

Important NVDS schema concepts

Only meta-schema and operational schema are installed by default

Schema is only extended with needed definitions

All schema definitions in NVDS are normal objects

eDirectory restrictions on schema no longer apply

Unlike eDirectory, where they were stored on the object class definition, containment and naming constraints are now separate objects

Derived Syntax Definitions

Simplifies defining multiple attributes with similar restrictions

Can define values for any restrictions allowed on the base (parent) syntax definition

Values have to be at least as restrictive as on base

Requires values for

oid = unique value

objectClass = syntax

subSyntaxOf = oid or primaryMap of base definition

If base syntax supports more than one equality matching or validation rule, the derived syntax can choose the rules it will use for equality and validation

New Syntax Definitions

Useful if you need to define application-specific semantics for attribute types

Is stored as an octet string

Requires values for

oid = unique value

objectClass = syntax

You cannot supply values for equalityMatchingRule, subSyntaxOf and syntaxValidation

Your application must supply its own equality matching or syntax validation support, if needed

Done at client

Enforce DN Relationships

Allows automatic enforcement of two-way relationships between entries

Example: uniqueMember (group) and groupMembership (user)

Define by

Create attribute definition (syntax=dn) with

attributeValidation = enforceDNRelation

relatedDNAttribute = <related attribute> (syntax=dn)

Enforce DN Relationships
Example

o=Acme Corp.

ou=Engineering

cn=Admins

cn=Susan

groupMembership: cn=admins,o=Acme Corp.

cn=Bob

uniqueMember:
cn=susan,ou=Engineering,o=Acme Corp.

Enforce DN Relationships
Manual Approach

dn: cn=admins,o=Acme Corp.

changetype: modify

add: uniqueMember

uniqueMember: cn=susan,ou=Engineering,o=Acme Corp.

dn: cn=Susan,ou=Engineering,o=Acme Corp.

changetype: modify

add: groupMembership

groupMembership: cn=admins,o=Acme Corp.

Enforce DN Relationships
Automatic Definition Example

# Define uniqueMember attribute

dn: oid=2.5.4.50,sc=definition,sc=dsaSchema,sc=local

control: 2.16.840.1.113730.3.4.2 true

control: 2.16.840.1.113719.1.27.101.19 true

changetype: add

objectClass: attribute

type: taggedDNAndString

#equalityMatchingRule: uniqueMemberMatch

relatedDNAttribute: groupMembership

attributeValidation: enforceDNRelation

primaryMap: uniqueMember

Enforce DN Relationships
Automatic Definition Example

# Define groupMembership attribute type

dn: oid=<unique_oid_value>,sc=definition,sc=dsaSchema,sc=local

control: 2.16.840.1.113730.3.4.2 true

control: 2.16.840.1.113719.1.27.101.19 true

changetype: add

objectClass: attribute

type: 1.3.6.1.4.1.1466.115.121.1.12

# Allow if authenticated identity has rights to modify and delete source

relationAccess: 3

# Only internal NVDS modules can add destination

addAccess: 1

primaryMap: groupMembership

Enforce DN Relationships
Example

o=Acme Corp.

ou=Engineering

cn=Admins

cn=Susan

groupMembership: cn=admins,o=Acme Corp.

cn=Bob

uniqueMember:
cn=susan,ou=Engineering,o=Acme Corp.

Administrative Points

Administrative Points

Allow you to easily store administrative information

Special "administrative policy locator" attributes on each entry tell where this information is stored

Several predefined types

Login policy

Password policy

Authentication activation policy

New administrative types can be application defined

Administrative Point Placement

Administrative points may be placed on any entry

Outer administrative points

Define the boundary of a new administrative area

Inner administrative points

Allow additional policies to be defined and combined together within an administrative area

Administrative areas for different types of policies are independent

Administrative Point Example

Entries within Outer 1 use policies in Outer 1

Entries with Inner 1 user combined policies of Inner 1 and Outer 1

Combination method is policy-defined

Entries within Outer 2 use policies from Outer 2

Outer 2 policies are independent of Outer 1 policies

May be more or less restrictive

Outer 1

Outer 2

Inner 1

Administrative Point Example

Entries within Outer 1

Password min length = 8

Entries within Inner 1*

Password min length = 8

Password min 2 alpha + 2 numeric

Entries within Outer 2

Password min length = 5

Outer 1 – Password min length = 8

Inner 1 – Password min 2 alpha

+ 2 numeric characters

Outer 2 – Password min length = 5

*Example for illustration only. Inner admin points are not supported for password policies in NVDS 1.0

Role Activation/Deactivation

Automatic Role Activation

Occurs when authentication requests succeed

Adds the following identities to the active role list

DN of entry used in authentication and all superiors

authenticated or unauthenticated

Are real entries in sc=system subentry container

Also adds these identities based on local authentication activation administrative area

DNs in securityEquals attribute

Object classes in objectClass and dseObjectClass attributes

Are real entries in sc=dsaSchema subentry container

RBAC role membership

Used by iManager for calculating roles

RBAC Activation Rules
Single Unconstrained

Compiles a target list of attribute types stored in the authActivationSingleUnconstrained attribute for the administrative area (inner and outer areas)

Typically objectClass, DSEObjectClass, securityEquals, and groupMember

Reads DN values from target attribute list on the authenticating entry

Adds those DNs to the active role list without checking for any activation constraints

RBAC Activation
Single Unconstrained Example

o=Acme Corp.

ou=Engineering

cn=Susan

cn=Bob

cn=Engineering Roles

cn=Engineer

cn=Build Manager

cn=Architect

cn=Team Lead

teamAssignments:
cn=Engineer,cn=Engineering Roles
cn=Team Lead,cn=Engineering Roles

authActivationSingleUnconstrained:
teamAssignments

RBAC Activation Rules
Hierarchical Constrained

Compiles a target list of attribute types stored in the authActivationHierarchicalConstrained attribute for the administrative area (inner and outer areas)

Typically rbacStaticRoleMemberOf

Reads DNs from target attributes on authenticating entry and adds them to the active role list

Hierarchically follows the rbacDescendant attribute on these entries and their descendants and adds them to the active role list

RBAC Activation
Hierarchical Constrained Example

o=Acme Corp.

ou=Engineering

cn=Susan

cn=Bob

cn=Employee Roles

cn=Employee

cn=Director

cn=Manager

cn=Vice President

rbacStaticRoleMemberOf:
cn=Vice President,cn=Employee Roles

authActivationHierarchicalConstrained:
rbacStaticRoleMemberOf

Role Activation and Deactivation

Allows application to use principle of least privileges for any given task

Two lists

Available role list

Active role list

Add roles to and/or remove roles from active role list in a single operation

LDAP extended operation

SOAP operation

Defining New Administrative Types

Defining New Administrative Types

You can define new administrative types that can be used in conjunction with administrative points

Administrative types can be used to store and retrieve policies for your application based on placement of related administrative points

Defining New Administrative Types

Define OIDs to represent administrative roles

Add these administrative roles to the administrativeRole attribute schema definition

Define new schema attribute types to hold administrative policy information

Define a new auxiliary class to hold schema attribute types

Modify the subEntry definition to allow the auxiliary class

Define administrative policy locator attribute

Modify baseOperational schema definition to allow the locator attribute

Defining New Administrative Types
Example – Automatic Role Activation Definition

# Define the OIDs for outer and inner administrative roles to be

# activated when authentication occurs

dn: oid=2.16.840.1.113719.1.1.106.14,sc=definition,sc=dsaSchema,sc=local

control: 2.16.840.1.113730.3.4.2 true

control: 2.16.840.1.113719.1.27.101.19 true

changetype: add

objectClass: oidDefinition

primaryMap: authActivationRoleOuter

dn: oid=2.16.840.1.113719.1.1.106.15,sc=definition,sc=dsaSchema,sc=local

control: 2.16.840.1.113730.3.4.2 true

control: 2.16.840.1.113719.1.27.101.19 true

changetype: add

objectClass: oidDefinition

primaryMap: authActivationRoleInner

Defining New Administrative Types
Example – Automatic Role Activation Definition

# Modify administrativeRole to allow the authActivation roles

dn: oid=2.16.840.1.113719.1.1.103.2.54,sc=definition,sc=dsaSchema,sc=local

control: 2.16.840.1.113730.3.4.2 true

control: 2.16.840.1.113719.1.27.101.19 true

changetype: modify

add: oidRestriction

oidRestriction: authActivationRoleOuter

oidRestriction: authActivationRoleInner

Defining New Administrative Types
Example – Automatic Role Activation Definition

# Define two authentication activation rules

dn: oid=2.16.840.1.113719.1.1.4.656,sc=definition,sc=dsaSchema,sc=local

control: 2.16.840.1.113730.3.4.2 true

control: 2.16.840.1.113719.1.27.101.19 true

changetype: add

objectClass: attribute

type: attributeName

primaryMap: authActivationSingleUnconstrained

dn: oid=2.16.840.1.113719.1.1.4.657,sc=definition,sc=dsaSchema,sc=local

control: 2.16.840.1.113730.3.4.2 true

control: 2.16.840.1.113719.1.27.101.19 true

changetype: add

objectClass: attribute

type: attributeName

primaryMap: authActivationHierarchicalConstrained

Defining New Administrative Types
Example – Automatic Role Activation Definition

# Add authentication rules to auxiliary class so they can be instantiated

dn: oid=2.16.840.1.113719.1.1.6.71,sc=definition,sc=dsaSchema,sc=local

control: 2.16.840.1.113730.3.4.2 true

control: 2.16.840.1.113719.1.27.101.19 true

changetype: add

objectClass: auxiliaryClass

primaryMap: authActivationRule

optional: authActivationSingleUnconstrained

optional: authActivationHierarchicalConstrained

# Modify subEntry to allow authentication rules

dn: oid=2.5.17.0,sc=definition,sc=dsaSchema,sc=local

control: 2.16.840.1.113730.3.4.2 true

control: 2.16.840.1.113719.1.27.101.19 true

changetype: modify

add: auxiliary

auxiliary: authActivationRule

Defining New Administrative Types
Example – Automatic Role Activation Definition

# Define the administrative locator attribute

dn: oid=2.16.840.1.113719.1.1.4.658,sc=definition,sc=dsaSchema,sc=local

control: 2.16.840.1.113730.3.4.2 true

control: 2.16.840.1.113719.1.27.101.19 true

changetype: add

objectClass: attribute

type: dn

primaryMap: authActivationAdministrativeArea

addAccess: 1

deleteAccess: 1

usage: 1

wildcardRetrievalAllowed: false

readRetrievalRule: readAdminSpecificArea

pseudoRead: pseudoReadAll

innerAdministrativeRole: authActivationRoleInner

outerAdministrativeRole: authActivationRoleOuter

subEntryAuxAdministrativeRole: authActivationRule

Defining New Administrative Types
Example – Automatic Role Activation Definition

#modify baseOperational to allow policy locator attribute

dn: oid=2.5.6.6,sc=definition,sc=dsaSchema,sc=local

control: 2.16.840.1.113730.3.4.2 true

control: 2.16.840.1.113719.1.27.101.19 true

changetype: modify

add: optional

optional: authActivationAdministrativeArea

Defining New Administrative Types
Example - Graphical Representation

ou=Engineering

cn=Susan

cn=Bob

Bob authenticates

cn=rbacPolicy

(subEntry)

o=Acme Corp.

Defining New Administrative Types
Example - Graphical Representation

Authentication activation system sees authentication event and reads its administrative policy locator attribute (authActivationAdministrativeArea) from cn=Bob

authActivationAdministrativeArea

ou=Engineering

cn=Susan

cn=Bob

cn=rbacPolicy

(subEntry)

o=Acme Corp.

Defining New Administrative Types
Example - Graphical Representation

NVDS looks for administrative points with

innerAdministrativeRole: authActivationRoleInner

outerAdministrativeRole: authActivationRoleOuter

authActivationAdministrativeArea

o=Acme Corp.

ou=Engineering

cn=Susan

cn=Bob

outerAdministrativeRole:

authActivationRoleOuter

Defining New Administrative Types
Example - Graphical Representation

NVDS searches below matching administrative points for subentries with

objectClass: authActivationRule

authActivationAdministrativeArea

ou=Engineering

cn=Susan

cn=Bob

cn=rbacPolicy

(subEntry)

objectClass: authActivationRule

o=Acme Corp.

Defining New Administrative Types
Example - Graphical Representation

NVDS returns the DNs of these subentries as values

authActivationAdministrativeArea: cn=rbacPolicy,o=Acme Corp.

authActivationAdministrativeArea

o=Acme Corp.

(outer admin point)

ou=Engineering

cn=Susan

cn=Bob

cn=rbacPolicy

(subEntry)

Defining New Administrative Types
Example - Graphical Representation

Authentication activation system now knows its policy information is stored at cn=rbacPolicy,o=Acme Corp.

It reads the information and uses it to calculate the active role list

o=Acme Corp.

(outer admin point)

ou=Engineering

cn=Susan

cn=Bob

cn=rbacPolicy

(subEntry)

Developing to NVDS

Getting Started with NVDS

Get access to NVDS Forge site

Download binaries and doc

Experiment and Prototype

Code Your Application

Getting help

Get Access to NVDS Forge site

Get a Forge account if you don't already have one

http:/www.forge.novell.com

Click Register with Novell Forge

Add the NVDS project to your list of projects

The next time you login to Forge, the Novell Virtual Directory Services project will show up in your list of projects and communities

Download Developer Install

Where to get builds

Click on Files, Binaries, NVDS 1.0 Installers

Pick the latest release

select Debug or Release

Linux: novell-nvds_de.bin

Windows: novell-nvds_de.exe

Allows you to quickly get a fully-functional NVDS system installed for prototyping and development

NVDS

Schema definitions

iManager

Download Documentation

Technical Overview

Information about NVDS architecture and design

Oriented to developer audience

Developer Guide

Describes how to install and configure and develop applications using NVDS

Describes how to embed NVDS into the installation program for your application

Schema Guide

Describes the schema architecture, meta-schema definitions and schema definitions

Experiment and Prototype

At this point you have a basic directory server where the LDAP anonymous identity has all rights, and you're ready to begin experimenting with NVDS

Eventually you'll want to...

Embed the install of NVDS into your application's install

Write and configure NVDS with custom schema tailored to your application

Create additional identities, grant them appropriate administrative rights, and then revoke rights from anonymous

Do this once you've established a beachhead with the NVDS Developer Install

Code Your Application

Directory Access

Via your favorite LDAP SDK

Will require extensions

Novell's LDAP SDK can be downloaded from Files page

Already supports all extensions

SOAP Access (management)

WebServices SDK can be downloaded from Files page

Getting Help

nvds-users mail list

Primary way to get contact project developers for assistance

Staffed by project developer champion

Summary

NVDS Use Cases

NVDS 1.0 Features and Capabilities

Administration Services

Directory Services

Security Services

Advanced Features

NVDS Developer Environment and SDKs

Certificate management includes

Generate a certificate signing request and then import the resulting certificate generated from a certificate signing authority

Create a certificate

Import a trusted root certificate
Import a certificate chain (the equivalent of a KMO in eDirectory)

Certificate management includes

Generate a certificate signing request and then import the resulting certificate generated from a certificate signing authority

Create a certificate

Import a trusted root certificate
Import a certificate chain (the equivalent of a KMO in eDirectory)

2003-12-08T12:43:39

Roger Harrison