Oracle Internet Directory Administrator's Guide Release 2.1.1 Part Number A86101-01 |
Library | Service | Contents | Index

# 1
Introduction

This chapter is an introduction to online directories, provides an overview of the Lightweight Directory Application Protocol (LDAP) version 3, and explains some of the unique features and benefits of Oracle Internet Directory.

This chapter contains these topics:

- What Is a Directory?

- What Is LDAP?

- What Is Oracle Internet Directory?

## What Is a Directory?

A directory organizes information so that you can find it easily. It lists objects--for example, people, books in a library, or merchandise in a department store--and gives details about each one. A telephone book is a familiar type of directory, a card catalog in a library is another, and a department store catalog still another.

This section contains these topics:

- Online Directories

- The Difference Between Online Directories and Relational Databases

- The Problem: Multiple Special Purpose Directories

- The Solution: The LDAP-Compliant General Purpose Directory

### Online Directories

An online directory is a specialized database that stores and retrieves collections of information about objects. Such information can represent any resources that require management: employee names, titles, and security credentials; information about e-commerce partners; or information about shared network resources such as conference rooms and printers.

Directories can be used by a variety of users and applications, for a variety of purposes. A few typical scenarios include:

- An employee searching for corporate whitepage information, and, through a mail client, looking up email addresses

- An application, such as a message transport agent, locating a user's mail server

- A database application identifying user role information

### The Difference Between Online Directories and Relational Databases

A database is a structured collection of data. Although an online directory is a database, it is not a relational database. The following table contrasts online directories with relational databases.

Online Directories | Relational Databases
--- | ---
Primarily read-focused. Typical use involves a relatively small number of data updates, and a potentially large number of data retrievals. | Primarily write-focused. Typical use involves continuous recording of transactions, with retrievals done relatively infrequently.
Designed to handle relatively simple transactions on relatively small units of data. For example, an application might use a directory simply to store and retrieve an e-mail address, a telephone number, or a digital portrait. | Designed to handle large and diverse transactions using many operations on large units of data.
Designed to be location-independent. Directory applications expect, at all times, to see the same information throughout the deployment environment--regardless of which server they are querying. If a queried server does not store the information locally, then it must either retrieve the information or point the client application to it transparently. | Typically designed to be location-specific. While a relational database can be distributed, it usually resides on a particular database server.
Designed to store information in entries. These entries might represent any resource customers wish to manage: employees, e-commerce partners, conference rooms, or shared network resources such as printers. Associated with each entry is a number of attributes, each of which may have one or more values assigned. For example, typical attributes for a `person` entry might include first and last names, e-mail addresses, the address of a preferred mail server, passwords or other login credentials, or a digitized portrait. | Designed to store information as records in relational tables.

### The Problem: Multiple Special Purpose Directories

According to some estimates, each of the world's largest companies has an average of 180 different directories, each designated for a special purpose. Add to that the various enterprise applications, each with its own additional directory of user names, and the actual number of special purpose directories becomes even higher.

Managing so many special purpose directories can cause three problems:

- Inconsistent data: Updated information in one directory is not shared with all the other directories.

- Redundancy: The same information is represented in many different places in the enterprise.

- High cost of administration: Administrators must maintain essentially the same information in many different places.

For example, when an enterprise hires a new employee, administrators must create a new user identity on the network, create a new e-mail account, add the user to the human-resources database, and set up all applications that the employee may need--for example, user accounts on development, testing, and production database systems. Later, if the employee leaves the company, administrators must reverse the process to disable all these user accounts. In addition to this administrative overhead, it can be difficult for multiple administrators entering redundant information in multiple systems to synchronize this employee information across all systems. The result can be inconsistent data across the enterprise.

### The Solution: The LDAP-Compliant General Purpose Directory

Clearly there is need for a more general purpose directory infrastructure, one based on a common standard for supporting a wide variety of applications and services. Oracle Internet Directory answers this need through its use of the Lightweight Directory Access Protocol (LDAP).

## What Is LDAP?

The Lightweight Directory Access Protocol (LDAP) is a standard, extensible directory access protocol. It is a common language that LDAP clients and servers use to communicate.

LDAP was conceived as an internet-ready, lightweight implementation of the International Standardization Organization (ISO) X.500 standard for directory services. It requires a minimal amount of networking software on the client side, which makes it particularly attractive for internet-based, thin client applications.

This section contains these topics:

- LDAP and Simplified Directory Management

- LDAP Version 3

### LDAP and Simplified Directory Management

The LDAP standard simplifies management of directory information in three ways:

- It provides all users and applications in the enterprise with a single, well-defined, standard interface to a single, extensible directory service. This makes it easier to rapidly develop and deploy directory-enabled applications.

- It reduces the need to enter and coordinate redundant information in multiple services scattered across the enterprise.

- Its well-defined protocol and array of programmatic interfaces make it more practical to deploy internet-ready applications that leverage the directory.

### LDAP Version 3

The most recent version of LDAP, Version 3, was approved as a proposed Internet Standard by the Internet Engineering Task Force in December 1997. LDAP Version 3 improves on LDAP Version 2 in several important areas:

- National Language Support: LDAP Version 3 allows servers and clients to support characters used in every language in the world.

- Knowledge references (also called referrals): LDAP Version 3 implements a referral mechanism that allows servers to return references to other servers as a result of a directory query. This makes it possible to partition a directory information tree (DIT) (described in Chapter 2) across multiple LDAP servers, enabling global deployment.

- Security: A standard mechanism for supporting Simple Authentication and Security Layer (SASL) and Transport Layer Security (TLS) were added, providing LDAP with a comprehensive and extensible framework for data security.

- Extensibility: LDAP Version 3 enables vendors to extend existing LDAP operations through the use of mechanisms called controls.

- Feature and schema discovery: LDAP Version 3 enables publishing information useful to other LDAP servers and clients, such as the supported LDAP protocols and a description of the directory schema.

  See Also: RFCs (Requests for Comments) 2251-2256 of the IETF, available on the Worldwide Web at: http://www.ietf.org/rfc.html "Related Documentation" for an additional list of resources on LDAP

## What Is Oracle Internet Directory?

Oracle Internet Directory is a general purpose directory service that enables retrieval of information about dispersed users and network resources. It combines LDAP Version 3 with the high performance, scalability, robustness, and availability of Oracle8i.

This section contains these topics:

- Oracle Internet Directory and Oracle8i

- Oracle Internet Directory Components

- The Advantages of Oracle Internet Directory

### Oracle Internet Directory and Oracle8i

Oracle Internet Directory runs as an application on Oracle 8i. It communicates with the database, which may be on the same or on a different operating system, by using Net8, Oracle's operating system-independent database connectivity solution. Figure 1-1 illustrates this relationship.

#### Figure 1-1 Oracle Internet Directory Architecture

Text description of the illustration oid81007.gif

### Oracle Internet Directory Components

Oracle Internet Directory includes:

- Oracle directory server, which responds to client requests for information about people and resources, and to updates of that information, using a multi-tiered architecture directly over TCP/IP

- Oracle directory replication server, which replicates LDAP data between Oracle directory servers

- Oracle Directory Manager, a Java-based graphical user interface administration tool

- A variety of command line administration and data management tools

### The Advantages of Oracle Internet Directory

Oracle Internet Directory provides these significant benefits:

- Scalability

- High Availability

- Security

#### Scalability

Oracle Internet Directory exploits the strengths of Oracle8i, enabling support for terabytes of directory information. In addition, such technologies as multithreaded LDAP servers and database connection pooling allow it to support thousands of concurrent clients with subsecond search response times.

Oracle Internet Directory also provides data management tools, such as Oracle Directory Manager and a variety of command line tools, for manipulating large volumes of LDAP data.

#### High Availability

Oracle Internet Directory is designed to meet the needs of a variety of important applications. For example, Oracle Internet Directory supports full, multi-master replication between directory servers: If one server in a replication community becomes unavailable, then a user can access the data from another server. Information about changes made to data on a server is stored in special tables on the Oracle8i database. These are replicated throughout the directory environment by Oracle's Advanced Symmetric Replication (ASR), a robust replication mechanism.

Oracle Internet Directory also takes advantage of all the availability features of the Oracle8i. Because directory information is stored securely in the Oracle8i database, it is protected by Oracle's backup capabilities. Additionally, the Oracle8i database, running with large datastores and heavy loads, can recover from system failures quickly.

#### Security

Oracle Internet Directory offers comprehensive and flexible access control. An administrator can grant or control access to a specific directory object or to an entire directory subtree. Moreover, Oracle Internet Directory implements three levels of user authentication, namely, anonymous, password-based, and certificate-based using Secure Socket Layer (SSL) Version 3 for authenticated access and data privacy.

| Copyright © 1996-2000, Oracle Corporation. All Rights Reserved. |
Library | Service | Contents | Index