Novell eDirectoryTM:
The Standard for Directory Services

Ivan Hurtt

Product Manager

ihurtt@novell.com

Shawn Dickerson

Product Marketing Manager

sdickerson@novell.com

Session Agenda

What is a directory and why would you use one

Types of directories

Value of a directory

The myth of one directory

The value of open standards/multi-platform support

Is LDAP good enough?

Novell eDirectory component technologies

Directory services competitors

Q&A

The What and When of
Directory Services

A directory is a specialized database – a catalog of information about people, devices and other resources.

Functions that a directory typically provides:

What is a Directory?

What is a Directory?

A directory is a specialized database – a catalog of information about people, devices and other resources.

Functions that a directory typically provides:

Identity (people, services and devices)

What is a Directory?

A directory is a specialized database – a catalog of information about people, devices and other resources.

Functions that a directory typically provides:

Identity (people, services and devices)

Security (authentication and access control)

What is a Directory?

A directory is a specialized database – a catalog of information about people, devices and other resources.

Functions that a directory typically provides:

Identity (people, services and devices)

Security (authentication and access control)

Relationships (groups and roles)

Directory

Extremely fast read operations

Relatively static data

Distributed

Hierarchical

Object-oriented

Standard schema

Multi-valued attributes

Multi-master replication

Source: “Should I Use a Directory, a Database or Both?” —Novell AppNotes

Database

Write-intensive operations

Data in flux or historical data

Application-specific schema

Complex data models

Data integrity

ACID transactions

Directories and Databases

Is the data relatively static?

Does the data need to be distributed?

Can the data be used by more than one application?

Is the data multi-valued?

Can your data or application take advantage of a hierarchical relationship?

Do you need flexible security options?

Do you need single sign-on?

Do you need distributed or delegated administration capabilities?

Source: “Should I Use a Directory, a Database or Both?” —Novell AppNotes

When to Use a Directory

Is the data relatively static?

Does the data need to be distributed?

Can the data be used by more than one application?

Is the data multi-valued?

Can your data or application take advantage of a hierarchical relationship?

Do you need flexible security options?

Do you need single sign-on?

Do you need distributed or delegated administration capabilities?

Source: “Should I Use a Directory, a Database or Both?” —Novell AppNotes

When to Use a Directory

If the answer is yes to some or all of these questions, you should definitely consider using a directory.

LDAP directory – Based on a widely accepted industry standard and typically used for basic capabilities like authentication and authorization

Full-service directory – Feature-rich directory often used as the hub of corporate identity information and the foundation for identity management solutions

Meta-directory – Synchronizes identity data among different directories

Types of Directories

Application directory – Lightweight directory implementation designed to support the specific needs of an application

Virtual directory – Provides a virtual, consolidated view into many directories

The Value of a Directory

Authentication and authorization

Centralized administration

Personalization

White/yellow pages

Improved security

Simplify administration to reduce costs

Improve service levels

More productive and effective collaboration

A directory helps equate IT with your business goals ... a place where written policy becomes manifest.

Feature

Benefit

Customer Deployments

Customer situation

No citywide mechanism for contacting city employees

No way even to know the exact number of city employees

Informational phone system lacked contact details

Novell eDirectory as directory for agency contacts

Sun needed 9 servers for every 1 Novell server

Sun directory does not scale when dealing with large #s of attributes

Citizens get the right information in a timely manner

Foundation for the informational phone system and citywide identity management

Greatly improved communication across city agencies

Approach

Business Results

Case Study: Municipal Government

Customer Situation

International airline based in Hong Kong

Operates in 150 locations with 14,600 employees, many of which are highly mobile

Needed to cut IT costs and provide secure, reliable remote access

Chose a Novell Nsure® solution to integrate IT systems

Created a secure Web portal providing remote access to apps

eDirectory serves as the central repository for identity and security data

Eliminated much of the manual administration associated with identity mgmt

Employees have secure, anywhere access to email and other apps

“Novell is the perfect solution for our distributed environment”

Business Results

Approach

Case Study: Cathay Pacific Airways

Customer Situation

Managing 58,000 students and 8,000 faculty and staff in more than 55 locations

Costly process to update user data across mainframes and dept apps

Students and teachers had to juggle multiple passwords

Selected Novell Nsure to integrate AD, legacy systems and many home-grown Web apps

Novell eDirectory provides central directory for schools and depts

Nsure Identity Mgr synchs identity data and passwords

Eliminated 200 hours of manual administration at the start of each school year

Significantly reduced the number of password-related helpdesk calls

“With Novell, we are not constantly playing catch up...”

Business Results

Approach

Case Study:
North East Independent School District

A Study in Mythology

Odin - chief among the gods in Norse mythology

Odin was a god of war and death, but also the god of poetry and wisdom. His attributes included the spear Gungnir and his eight-footed steed Sleipnir.

Zeus – chief among the gods in Greek mythology

Zeus was the supreme ruler of Mount Olympus and the gods who resided there. Associated with weather, his main attribute was the thunderbolt.

A single directory for the entire enterprise

Most directories today are tied to an OS or application platform. Consolidation is a costly endeavor without a lot of ROI.

Directory

Mythology

Zeus

Odin

What to look for...

LDAP Certified by The Open Group – the industry yardstick for signifying conformance to the LDAP standard

Compliance with DSML, SOAP and a host of other protocols

Multi-platform support for Linux, UNIX, Windows and others

Future-Proofing a Directory

What will you be doing and deploying two years from now?

Evaluating Linux and open source?

Considering identity federation or Web services?

Deploying a new enterprise-wide business application?

Considering an authentication method beyond simple passwords?

Is LDAP Good Enough?

...in some cases, yes ... depending on your goals

Basic authentication and authorization based on passwords

Core management functions with an LDAP tool

Simple, fairly static security model

Only supporting LDAP applications

Limited replication capabilities

Simple LDAP Directory

Advanced authentication with support for biometrics or tokens

Remote Web-based management and monitoring for all functions

Dynamic security model supporting inherited rights

Supporting a variety of access protocols

Unlimited multi-master replication

Novell eDirectory

Novell eDirectory Component Technologies

Management Tools

Maintenance

Administration

Novell iManager

Directory administration tasks available from the browser, including delegated administration

Directory Server Diagnostics

Novell iMonitor provides server mgmt and diagnostics from a browser

Monitoring Interfaces

SNMP events allow eDirectory to snap into standard enterprise management consoles

Comprehensive Repair Tools

Repair tools allowing repair of entire data set, partial data set and individual objects; replication repair utilities; and many low-level directory operations. Many of these tools work while online.

Corporate White Pages

Wireless Authentication

Username: rsmith

Password: ********

Novell contributes client code and publishes eDirectory APIs to the freeRADIUS project

Integration with freeRADIUS provides support for 802.11x wireless authentication

Password Self-Service

Dramatically reduce password reset calls with FREE password self-service for Novell eDirectory. Visit www.novell.com/self-service to see:

The benefits of password self-service

System requirements and a link to password management plug-ins

Deployment Guide, which walks you through the process of configuring password policies to establish self-service password reset

A product demo

Novell Modular Authentication Service

NMAS™ Provides Strong Authentication

Pluggable to adapt to the security needs of any organization

biometrics, Kerberos, smart cards, PKI, proximity cards and others

Graded authentication provides access based on the strength and combination of login method

eDirectory

NMAS

Kerberos

A Closer Look at
Competitive Offerings

Market Leadership – META Group

Weaknesses

…aka Sun ONE Directory Server; aka iPlanet Directory Server; aka Netscape Directory

Unlimited multimaster replication … as long as unlimited means 4 replicas

Not suitable for distributed environments; cannot partition the directory

Inconvenient and cryptic management tools

Cannot scale well with complex attributes

Sun Java System Directory Server

Strengths

Solid scalability and performance in many circumstances

Supported by many 3rd-party products

Weaknesses

Nobody’s network looks like this

Not LDAP Certified by The Open Group

Ongoing Windows security issues (the only platform for deployment)

Scalability that cannot reach Internet magnitudes without significant hardware investments

Strengths

Solid NOS directory, as long as your network looks like this

Microsoft developer program and partner support

AD/AM brings much greater flexibility in deploying a directory

Microsoft Active Directory & AD/AM

Weaknesses

Directory technology is not strategic to IBM

Simply an LDAP interface to DB2

Limited partner and 3rd-party product support

Strengths

Integral component of IBM’s identity management suite

IBM corporate and consulting resources

IBM Tivoli Directory Server

Questions & Answers

General Disclaimer

This document is not to be construed as a promise by any participating company to develop, deliver, or market a product. Novell, Inc., makes no representations or warranties with respect to the contents of this document, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc., reserves the right to revise this document and to make changes to its content, at any time, without obligation to notify any person or entity of such revisions or changes. All Novell marks referenced in this presentation are trademarks or registered trademarks of Novell, Inc. in the United States and other countries. All third-party trademarks are the property of their respective owners.

No part of this work may be practiced, performed, copied, distributed, revised, modified, translated, abridged, condensed, expanded, collected, or adapted without the prior written consent of Novell, Inc. Any use or exploitation of this work without authorization could subject the perpetrator to criminal and civil liability.

Decide how we want to spin Dynamic ACLs. Sun’s defn or ours.

Overview

Standard Life is Europe’s largest mutual life assurance company with assets under management in excess of £75 billion. It provides financial services to more than 5 million customers, and employs over 13,000 staff in offices throughout the United Kingdom, Republic of Ireland, Spain, Canada, Germany, Austria, Hong Kong, China and India.

Challenge

With more than 13,000 employees spread throughout the world, Standard Life faced several challenges relating to password management. Users were required to first log on to their workstations, then the mainframe system, and at times more than 10 separate applications. This led to users resorting to writing down passwords and displaying them, potentially jeopardizing company security.

Moreover, with so many passwords for users to recall, the IT helpdesk was continually bombarded with requests to reissue and reset passwords, increasing administration costs.

Standard Life wanted a secure, password management solution that would centralize management and reduce the number of password-related calls to the service desk. In addition, the company wanted to present a single point of authentication, enabling it to easily monitor both internal and external access to the system.

Solution

Following a thorough evaluation of various solutions, Standard Life selected Novell Nsure for its security, reliability and ease-of-use. The solution is delivered through best-of-breed products, including Novell eDirectory™, Novell SecureLogin and Novell BorderManager®.

“The Novell solution has increased our infrastructure security and improved our users’ productivity,” said Katie Holland IS Service Center project analyst, Standard Life. “We should have implemented Novell’s secure identity management solution sooner.”

Novell eDirectory, Novell’s premier directory service, stores Standard Life’s user identities and serves as the central access point for all applications and data. eDirectory allows the company to store millions of user identities in a single, centralized location.

Novell SecureLogin, another component of the secure identity management solution, enables secure and reliable password management. The directory-based, single sign-on solution encrypts and stores authentication credentials in Novell SecretStore®, a secure repository located within eDirectory, so that users are only required to enter their username and password once, and are then able to easily maneuver from application to application. Currently, Standard Life has deployed SecureLogin to more than 7,000 users and plans for a companywide rollout within 2003.

“Users won’t need to rely on their memories to recall so many passwords —SecureLogin will do it for them,” said Holland. “The solution will also protect our system against unauthorized access by verifying users’ credentials through the directory, ensuring the utmost security.”

SecureLogin works in parallel with the company’s Customer Internet Access (CIA) project, which uses Lightweight Directory Access Protocol (LDAP) authentication to validate external users and grant secure access to its corporate systems, while offering a common interface. Novell BorderManager is then used as the firewall proxy and manages access to the Internet. Through the Novell secure identity management solution, the company is now able to track who is accessing its corporate systems and avoid costly security breaches.

Results

Standard Life has already witnessed significant results from the Novell Nsure solution. The company now has a secure password management system, enhancing internal and external user productivity and ultimately impacting its bottom line.

With only one password to recall, the service desk has seen a considerable reduction in password-related incidents and calls, which will enable the company to reallocate valuable IT resources.

“Novell products are strategic and important to our business. The Novell Nsure solution has met all our needs — it has improved business productivity and overall security,” said Philip Murray, Standard Life Information Service Center manager. “We are very pleased with the results.”

This means that no work is lost with either the Novell Nsure UDDI corporate or testing solution.

Enterprises that build their UDDI solutions with Novell Nsure UDDI Server, are not only leveraging the deep experience Novell Identity Management foundation brings to the standard, they are securing their own future by building on an open standard implementation that will grow and scale with their corporate needs.

2003-12-08T12:43:39