Directory Services Futures

Ivan Hurtt

Product Manager

Novell, Inc.

Sachi Mangala

Director, Software Engineering

Novell, Inc.

Novell eDirectory
What was in version 8.7.3

Released in January 2004

Features

Added support for Windows 2003

Unix package-based installer

Novel Certificate Server 2.7

Bundled products

Novell iManager 2.0.2

Novell Modular Authentication Service 2.3

Novell eGuide 2.1.2

Novell eDirectory
8.7.3 Interim Releases

Feb 2004 – Jan 2005

Resolved around 550 defects

8.7.3 IR5 delivered to OES 1.0

Bug fixes

NCP engine support on SLES

Install changes

8.7.3 IR6 (Apr 2005)

Better memory management

Localization defect fixes

Novell eDirectory 8.8
Focus

Install & Usability Enhancements

Performance Improvements

Security Enhancements

New Developer Interfaces

Novell eDirectory 8.8
Features

Install & Upgrade Enhancements

Multi-Instance Support

Data Import (Bulk Load) Improvements

Priority Sync

Case Sensitive Password Policies

Encrypted Attributes

Encrypted Replication

Backup/Restore Enhancements

SASL-GSSAPI support

See it in the
BrainShare
Tech Lab

Install now fully scriptable

Install through YaST on SLES

FHS, LSB compliance

Specify alternate data (DIB) location

Supervisor right to [root] of directory no longer required to install server

Run service as non-root user on Linux / UNIX

Patchable

Install and update via Ximian Red Carpet

Install SecretStore by default with eDirectory

Removed dependency between eDirectory and iManager

Apply
config file,
start service

Run
Configuration
Wizard

Install
Application

3

1

2

Novell eDirectory 8.8
Install & Upgrade Enhancements

Server Health Check

To help you determine whether the server health is safe before upgrading

Runs by default with every upgrade and occurs before the actual package upgrade

You can also run the diagnostic tool ndscheck (dscheck on NetWare) to do the health checks

Patch Installer

Post eDirectory 8.8, you can easily update your system with the latest patches

You can also rollback to the previous patch

Novell eDirectory 8.8
Install & Upgrade Enhancements

Selectable options for performance improvements

Disable in-line change cache

Disable ACL templates on inetOrgperson

No schema check, Indexing off

Serious speed improvements

Multi-threading on client and server

ICE

LDIF

Directory

Import-Convert-Export Utility

Novell eDirectory 8.8
Data Import “BulkLoad” Improvements

Used for instant convergence for real-time attributes

Such as passwords

Configurable per attribute

Writes change to all replicas at once

Normal replication process negotiates the rest

LDAP Write

Without Priority Sync

LDAP Write

1

2

With Priority Sync

Application

Application

replication has no real order

writes all simultaneously

1

2

3

Novell eDirectory 8.8
Priority Sync

Customer Tree/Gold partition

137.65.1.250

Customer Tree/Platinum partition

137.65.1.251

Test Lab Tree/partition 1

137.65.1.207

Enterprise Tree/[all 200 partitions]

137.65.1.206

Partners Extranet Tree

137.65.1.205

Host more than one instance of eDirectory on a server

Novell eDirectory 8.8
Multi Instance Support

Novell eDirectory 8.8
Multi Instance Support

Benefits

Maximizes high-end host hardware

Opens up cool new performance configuration options

Dedicated IP address per service instance

Options

More than one tree per server

Multiple replicas of same tree / partition on a single server

Assign an interface for each partition to accelerate searches

Novell eDirectory 8.8
New Encryption Options

New Encryption Options

Encrypted Attributes

Ensures attribute is encrypted within the DIB

Encrypted attribute is on a per server basis

Access to encrypted attributes through clear text or secure channel (e.g., SSL)

Encrypted Replication

Set replication traffic to be encrypted

It is on a per partition or per replica basis

We’re investigating setting on a per-server basis

Novell eDirectory 8.8
Object-based Backup & Restore

Implemented through an extension to LDAP

Used to backup the attributes and attribute values of one object at a time

This interface will backup and restore all the attributes including the DS attributes associated with an object.

Returns same data as the Target Service Agent (TSANDS)

This feature is available through C LDAP and Java LDAP SDK

Advantage

Provides an ability to perform incremental backup, wherein the object is backed up only if there are changes to the object

Works on all eDirectory supported platforms

Backward compatible with TSA

Novell eDirectory 8.8
Case-Sensitive Passwords

In eDirectory 8.7.1 and 8.7.3, when you enabled Universal Password, the password was case-sensitive only when you logged in through Novell Client32

The password was not case-sensitive when you logged in through other clients (for example, eDirectory SDK or iManager).

With eDirectory 8.8, you can make your passwords case-sensitive for all the clients

Novell eDirectory 8.8
SASL-GSSAPI Support

The LDAP SASL-GSSAPI mechanism is an authentication module, which helps the LDAP server in authenticating to a user based on a Kerberos ticket

This support is targeted at LDAP application users in environments that already have the Kerberos infrastructure in place

Such users must be able to use the Kerberos tickets obtained from the Kerberos server to authenticate to the LDAP server without providing a separate LDAP user password

Novell eDirectory 8.8
Novell Kerberos Integration

Novell

Kerberos KDC

Kerberized

Application

Servers

Web Based

Management

Console

Workstation with Kerberos Client & Appln. clients

Authentication

& Tickets issue

LDAP

eDirectory

with

Kerberos

Realm Data

Application Access with Service Tickets

Performance enhancements

Security container caching

Improvements to sub-tree search

New memory managers

Better usability and performance through iManager with the VLV support

Improved scalability by overcoming the 256 file descriptor limit on Solaris

Improved Troubleshooting

Improved error logging options that logs errors to DSTrace & syslog along with their severity

Filtering of iMonitor Trace & DSTrace messages based on thread ID, connection ID and error number

Novell eDirectory 8.8
More enhancements

Novell eDirectory
Project “JC Bose”

High level features:

Further Installation & Usability Improvements

Replication Policies

Optimized Referrals

Group Enhancements

Federated Attributes

Attribute-based ACL values

Clustered support on Linux / Solaris

64 bit support on Linux / Solaris

Novell eDirectory
Project “JC Bose”

Optimized Referrals

Partitioning segments data

If server A gets a request for user “Tom”…

And “Tom” is not locally stored on Server A…

Server A must refer to one of the servers holding “Tom”…

But which one?

(This is what optimized referrals will solve)

A

B

Tom

C

Tom

D

Tom

WAN link

Directory Roles

NOS, Corporate

Application, virtualization

iChipset

LDAP SDK/

Micro

NVDS

eDirectory

Novell

Development

Application

Corporate

Disaster Recovery and DeTroubler

General information

Full Object Relational backup/restore with a Global View

Automated Full Tree Restore, & Single Object Recovery

How is this accomplished

Backup Engine restores Schema, Partitioning & Objects

FileServer Agent adds Servers, SSI, & Trusteeships

For more information

Contact the Blackbird Group, Silver Sponsor, Booth# S155

www.blackbirdgroup.net/products/detroubler.htm

Telephone and Fax at (866) 224-8330

LDAP-GENERAL Benefits

Data integrity

Data protection

Prevents abuse by root

Prevents data snooping

Provides non-repudiation

Provides real-time alerts

Enhances uptime

Lowers operational costs

Prevents financial losses

Regulatory compliance

A brief look at
Novell Virtual Directory Services

Evolved

The role directories play has matured.

Enterprise, extranet, and internet-facing directories now face heavy change control constraints.

The classic

Corporate

Directory

Glass House

CHANGES

Novell Virtual Directory Services

Applications

Need access to centrally stored Identities

Need to make modifications to that data

Need to store their own app-specific identity data

Schema
changes

Applications need identity services, but the directory has become a highly protected asset.

Glass House

CHANGES

NVDS

BDobbs

Password

Telephone #

Address

All LDAP calls

BDobbs

Preference 1

Preference 2

Application

NVDS

NVDS conjoins the attributes into a single identity for the application

BDobbs

Password

Telephone No.

Address

App Pref 1

App Pref 2

Authoritative Identity requests

Central Identity

NVDS

General Disclaimer

This document is not to be construed as a promise by any participating company to develop, deliver, or market a product. Novell, Inc., makes no representations or warranties with respect to the contents of this document, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc., reserves the right to revise this document and to make changes to its content, at any time, without obligation to notify any person or entity of such revisions or changes. All Novell marks referenced in this presentation are trademarks or registered trademarks of Novell, Inc. in the United States and other countries. All third-party trademarks are the property of their respective owners.

No part of this work may be practiced, performed, copied, distributed, revised, modified, translated, abridged, condensed, expanded, collected, or adapted without the prior written consent of Novell, Inc. Any use or exploitation of this work without authorization could subject the perpetrator to criminal and civil liability.

This means that no work is lost with either the Novell Nsure UDDI corporate or testing solution.

Enterprises that build their UDDI solutions with Novell Nsure UDDI Server, are not only leveraging the deep experience Novell Identity Management foundation brings to the standard, they are securing their own future by building on an open standard implementation that will grow and scale with their corporate needs.

2004-03-18T16:00:25