240 likes | 474 Views
Directory Services. CS5493/7493. Directory Services. Directory services represent a technological breakthrough by integrating into a single management tool: Authentication Access control Accounting. Directory Services. A directory service organizes data into objects.
E N D
Directory Services CS5493/7493
Directory Services • Directory services represent a technological breakthrough by integrating into a single management tool: • Authentication • Access control • Accounting
Directory Services • A directory service organizes data into objects. • The directory holds the objects. • The directory service provides the tools for accessing and modifying the objects.
Directory Service Objects • These objects consist of a name and a group of attributes associated with the name. • The object name is formally known as the object’s “Distinguished Name” • An object can be a service, hardware, or user.
Directory Service Examples • A phonebook – entries in the phonebook are indexed by name. The name has a phone number and address associated with the name. • DNS – maps human readable names of network resources to their respective (binary) numeric network address.
Software Engineered D.S. • A software engineered directory service stores, organizes, and provides access to electronic information in a directory. • DNS was the first Internet directory service.
X.500 • A standard model for general-purpose directory services was developed in the late 1980’s. • The X.500 standard emerged from this effort in 1988. • A series of supplementary editions and refinements to X.500 followed.
X.500 Refinements • Shadowing (copying) directory information • Access controls • Additional administrative capabilities • Contexts – define actions for an object according to the context of the objects use. • Additional security features
X.500 Concept • There is a single directory information tree (DIT) • The DIT is a hierarchical organization of objects distributed across one or more servers. • Provides the protocol for querying and updating objects in the DIT.
X.500 Legacy • The general framework of X.500 has been adopted in more popular (widely adapted) directory services like: • LDAP, lightweight directory access protocol. OpenLDAP is available for Linux. • MicroSoft Active Directory
LDAP • Defines a simple protocol that will manage directory objects: • Search and retrieve • Add • Modify • Delete • Rename • LDAP uses a client-server model.
LDAP Model • LDAP uses a client-server model. • The LDAP protocol uses TCP/IP
LDAP Protocol • The LDAP client establishes a connection to an LDAP server. • The LDAP protocol usually uses port 389. • The client must authenticate itself to the server by supplying a distinguished name and password. • The LDAP server can restrict access to directory objects by managing permissions (access control)
MS Active Directory • A collection of services for managing resources in a computer network (LAN, MAN, CAN, or WAN).
The AD Collection of Services • AD Lightweight Directory Service • AD Federation Service • AD Certificate Service • AD Rights Management Service • AD Domain Service
AD Lightweight Directory Service • A lightweight version of AD based on LDAP.
AD Federation Service • A single sign-on service allowing a user to access services in different network environments using AD-FS. • The different network environments can be different companies running AD-FS.
AD Certificate Service • Issues public key certificates used for such things as authentication with smart cards; or encrypting data transmitted over a network. • This service can renew or revoke certificates.
AD Rights Management Service • Goes beyond access control. • AD-RMS manages (controls) what users can do with data once they have accessed the data. • Can prevent files from being copied (this includes disabling cut and paste. • Prevent saving or forwarding e-mail messages.
AD Domain Services • The traditional features of AD from previous versions.
Active Directory Summary • A hierarchical framework of data objects. • AD objects are categorized as • Resources: computers, printers, etc. • Services like e-mail • Users and groups of users • Any real component and its attributes
Active Directory Summary • A logical structure = grouping objects together based on criteria other than physical location. • A physical structure = grouping objects together based on a physical topology (all the users, equipment, and services located in a particular office building).
Active Directory Summary • Acts as the central point for managing object security • Individual user policies can be defined • Group policies can be defined • Auditing features: • Monitoring object usage • Create reports on object usage • Notify personnel of object usage
Active Directory Summary • Objects are organized into containers called Organizational Units (OU). • Organizational Units belong to a domain. • A domain is an administrative boundary. All the objects in a domain operate with the same security policy.