Using LDAPv 3 for Directory-Enabled Applications Networking

Using LDAPv 3 for Directory-Enabled Applications & Networking Greg Lavender Director of Technology Innosoft International, Inc. Greg. Lavender@innosoft. com Ó 1999 Innosoft International, Inc. innosoft international inc.

An LDAP-enabled Enterprise Directory Infrastructure HR, Facilities, etc. Mail, web, chat, etc. Existing DBMS Intranet services X. 509, SSO, PAM, NTDC Unified login services LDAP-enabled Enterprise Directory Backbone (multiple distributed LDAP servers) VPN Routers, Firewalls, RAS Devices Applications Telecomm, Workflow, etc. Ó 1999 Innosoft International, Inc. PKI sync Legacy Directories System Mgmt NDS, Notes, X. 500 DNS, DHCP, SLP innosoft international inc.

How to Get There • Top-down – identify authoritative directory data sources • export and load data into an LDAP directory – periodic or on-change synchronization to get updates – eventually you might make the directory authoritative – incrementally deploy LDAP-enabled user applications • easiest is a white pages directory for web or email • requires you to set security and access control policies • eventually allow users to update their own information Ó 1999 Innosoft International, Inc. innosoft international inc.

How to Get There • Bottom-up – LDAP-enable the network application infrastructure • web server authentication • remote access authentication (e. g. , RADIUS) • firewall user authentication • POP and IMAP mail authentication • host and IP address management • policy based routing and VPN security • directory in support of public-key authentication Ó 1999 Innosoft International, Inc. innosoft international inc.

Example Applications • Enterprise whitepages directory • Enterprise network services directory • ISP high volume messaging • Voice-over-IP use of directory Ó 1999 Innosoft International, Inc. innosoft international inc.

LDAP Enterprise Whitepages Directory Enterprise Web Users Web Servers High Availability 24 x 7 LDAP Directory Service Hub high availability heartbeat (Ethernet) HTTP LDAP Sun Ultra. SCSI Disk Array 2 x 4 GB Enterprise Mail Users storage (mirror) LDAP Innosoft Server 4 x 9 GB storage (primary) 2 x 4 GB storage (mirror) Ultra. SPARC 2 Solaris 2. 6 Sun E 3000 Solaris 2. 6 Directory Manager Ó 1999 Innosoft International, Inc. 1 x 300 MHz processor Veritas FS LDAP HTTP SNMP Veritas FS 512 MB memory 2 x 336 MHz processors 2 x 4 GB storage 2 GB memory (primary) 2 x 4 GB storage (primary) Sun Console innosoft international inc.

Enterprise Network Services with LDAP Proxy & Replicated Servers Web Server LDAP access for user authentication HTTP LDAP Extranet/ Internet access control load balancing & failover Replicated LDAP Servers LDAP Proxy SMTP/POP/IMAP LDAP access for user authentication, mail routing, and delivery options Mail Server Ó 1999 Innosoft International, Inc. innosoft international inc.

High Volume ISP Mail Services with Replicated LDAP Servers Multiple boundary SMTP relays with local LDAP replica for high performance user authentication and mail routing SMTP/POP/IMAP Internet LDAP Replication Master LDAP Server Ó 1999 Innosoft International, Inc. innosoft international inc.

LDAP Directory in a Vo. IP System Call Processing Server Phones Vo. IP Network Each CPS caches routing table and sets an LDAP “search trigger” to be notified in the event of a route update When routing update occurs, LDAP search trigger fires and asynchronously updates each CPS LDAP Directory Server LDAP server used as a routing and subscriber authentication database Ó 1999 Innosoft International, Inc. innosoft international inc.

Key Considerations • Performance and scalability – 500+ queries/sec with 1 CPU, millions of directory entries • Replication for high availability – multiple slaves AND multiple masters for high availability • Security and access control – SSLv 3 for authentication and encryption – LDAP firewall proxy as front-line of defense • Load balancing and failover – proxy server to distribute queries and detect failures Ó 1999 Innosoft International, Inc. innosoft international inc.

High Availability • Directories have become mission critical – users get used to accessing data 24 x 7 – critical applications require 100% availability • Option 1: provide HA with expensive hardware – centralize data and provide hardware fault tolerance • Option 2: provide HA with lower cost hardware – distribute and replicate data for high availability – provide failover and load balancing Ó 1999 Innosoft International, Inc. innosoft international inc.

High Availability LDAP Services • Put authoritative information close to users • No single point of failure (multiple masters) • Deal with failure transparently • Distribute work load for efficiency • All of the above lead to 24 x 7 availability Ó 1999 Innosoft International, Inc. innosoft international inc.

Fallback Multi-Master Replication • Uses LDAPv 3 – weakly consistent replication • based on “anti-entropy” protocol concepts • reduced bandwidth demands • Primary and secondary master servers – masters coordinate to remain consistent – multiple slaves for scalability and fast response time – “second-level slaves” to support replication hierarchies Ó 1999 Innosoft International, Inc. innosoft international inc.

A HA LDAP Server Scenario Primary Master Fallback Master synchronization Updates Incremental Update Propagation Referral Replicated Slaves Updates Secondary Slave Ó 1999 Innosoft International, Inc. innosoft international inc.

LDAP Proxy Server • A secure “chaining” LDAP server – configurable query filtering for security • blocks denial-of-service attacks • stops “trawling” – filters connections, search requests • access control groups • can rewrite search requests/results – transparently forwards operations to one or more servers – does automatic failover Ó 1999 Innosoft International, Inc. innosoft international inc.

Load Balancing Searches or Updates Load Balancing/Failover LDAP Proxy Servers Forward Operations to a Server in a Server Group Master or Slave Servers LDAP proxy server monitors directory servers for load and balances operations across masters or slaves in a server group. Also applies coarse grained access control Ó 1999 Innosoft International, Inc. innosoft international inc.

Transparent Failover Searches or Updates Load Balancing/Failover Proxy Servers Forward Operations to a Server in a Server Group Masters or Slaves Proxy server monitors directory servers and detects server failure and redirects operations until recovery Ó 1999 Innosoft International, Inc. innosoft international inc.