LDAP Directory Integration for ISP's and Enterprises

							LDAP Directory Integration
 for ISP's and Enterprises




                                      Authors:

                   Nickolay Rashev, Bianor Ltd.
                 Kostadin Jordanov, Bianor Ltd.




                               November 2002




          -1-
                                             Contents


Abstract ....................................................................................................... 3
What is a directory? ....................................................................................... 4
Directory clients and servers ........................................................................... 5
Directory security and management ................................................................ 5
Directory versus database .............................................................................. 7
The directory as infrastructure ........................................................................ 8
The LDAP directory standard ........................................................................... 8
LDAP directory products ................................................................................. 8
Value for the enterprise: short-term, long-term benefits, and ROI ....................... 9
  Short-term benefits .................................................................................... 9
  Long-term benefits ................................................................................... 10
  Security Management ............................................................................... 10
  Network Management ............................................................................... 10
  Systems Management ............................................................................... 11
  E-commerce and business process applications ............................................ 11
  Competitive Advantage ............................................................................. 11
  Directory ROI ........................................................................................... 11
Directory service integration for ISP's and Hosting companies – a case study ...... 12
  Key features and advantages of WireFlame Web Hosting ............................... 12
  For Hosting Providers ................................................................................ 13
  For Technical Staff .................................................................................... 13
  For End-users........................................................................................... 13
Conclusion .................................................................................................. 14
Contacts ....................................................... Error! Bookmark not defined.14




                                                  -2-
Abstract

The directory project analysis includes both the short-term and long-term benefits of
a directory infrastructure. The short-term benefits are related to administrative
overhead and the quality of directory information. Managing multiple directories that
contain similar information escalates administrative costs and reduces the quality of
information in the directory.

For ISP’s and hosting companies, integrated web hosting system saves valuable
management resources by automating the time consuming aspects of web hosting.
Such a system provides a simple, integrated, and easy to use web interface that
allows both client's and provider's technical staff to easily maintain all clients and
accounts. Using a directory-centric hosting system insures that a manageable,
secure, and scalable solution is in place to support the need for business growth.

The benefits of an enterprise directory deployment far outweigh the costs of
maintaining multiple directories. Companies can get a return of approximately five
times their directory investment, depending on how many directories they integrate.
That return will manifest itself in administrative and support cost savings related to
directory management.

It’s more difficult to measure the long-term benefits, but they’re equally important.
Over the long term, the directory will become an essential part of the enterprise
computing infrastructure, providing the foundation for a variety of applications and
services. E-commerce, extranet, and other distributed applications will not scale
without a solid directory foundation. Policy-based management systems will use the
directory to reduce the costs of managing desktop computers, network devices, and
other systems. They’ll also increase the efficiency of the network, allowing managers
to personalize the network to fit the needs of individuals, groups, and applications.

This combination of short-term and long-term benefits clearly justifies a directory
investment on the part of organizations that are trying to simplify their internal
network environments while simultaneously trying to extend their networks to
support extranet and e-commerce applications.




                                       -3-
What is a directory?

A directory is a listing of information about objects arranged in some order and that
gives details about each object. Common examples are a city telephone directory
and a library card catalog. For a telephone directory, the objects listed are people;
the names are arranged alphabetically, and the details given about each person are
address and telephone number.

In computer terms, a directory is a specialized database, also called a data
repository, that stores typed and ordered information about objects. Today, almost
every application that involves communication comes with some kind of directory.
Human Resources and Enterprise Resource Planning (ERP) applications such as
PeopleSoft and SAP are becoming critical in large organizations.

Without realizing it, we all use directory services, whether on the Internet or at work
when we need to get some information. When you type in a URL on a web browser,
such as http://www.bianor.com, this must be translated into an IP address via the
Domain Name System (DNS). Thus, DNS is a directory that you use.




One example that has generated a lot of interest is Directory-Enabled Network. This
is an example of LDAP being viewed as a factor in easing the management of many
different components of distributed systems. It may also provide the capability to
centralize the management of these distributed systems without reducing security or
increasing complexity.

Today, the developers of directory-enabled applications are faced with a problem.
What if they cannot assume that a directory service will exist in all environments? If
there is a directory service, it might be specific to a certain operating environment or
e-mail system, making the application non-portable. Can the existing directory


                                        -4-
service be extended to store the type of information needed by all applications?
Because of these concerns, application developers often take the approach of
developing their own application-specific directory. To avoid this obvious waste of
time and energy (by reinventing the wheel on every application), directory standards
were created by international bodies like ISO, CCITT, ITU-T.



Directory clients and servers

Directories are usually accessed using the client/server model of communication. An
application that wants to read or write information in a directory does not access the
directory directly. Instead, it calls a function or application programming interface
(API) that causes a message to be sent to another process. This second process
accesses the information in the directory on behalf of the requesting application.




The request is performed by the directory client, and the process that maintains and
looks up information in the directory is called the directory server. In general,
servers provide a specific service to clients. Sometimes, a server might become the
client of other servers in order to gather the information necessary to process a
request.



Directory security and management

The security of information stored in a directory is a major consideration. Some
directories are meant to be accessed publicly on the Internet, but any user should
not necessarily be able to perform any operation. A company’s directory servicing its
intranet can be stored behind a firewall to keep the general public from accessing it,
but more security control is needed within the intranet itself.

For example, anybody should be able to look up an employee’s e-mail address, but
only the employee or a system administrator should be able to change it. Members
of the personnel department might have permission to look up an employee’s home


                                       -5-
telephone number, but their co-workers might not. Perhaps information needs to be
encrypted before being transmitted over the network. A security policy defines who
has what type of access to what information. The security policy is defined by the
organization that maintains the directory.

Herein we focus on the three aspects of directory security: authentication, integrity
and confidentiality. There are several methods that can be used for this purpose; the
most important ones are discussed here. These are:

No authentication

This is the simplest way, one that obviously does not need to be explained in much
detail. This method should only be used when data security is not an issue and when
no special access control permissions are involved. This could be the case, for
example, when your directory is an address book browsable by anybody.

Basic authentication

Beside the option of using no authentication at all, the most simple security
mechanism in LDAP is called basic authentication. When using basic authentication
with LDAP, the client identifies itself to the server by means of an ID and a password
that are sent in the clear over the network. It is a relatively simple encryption, and
therefore it is not hard to break once one has captured the data on the network.

Simple Authentication and Security Layer (SASL)

SASL is a framework for adding additional authentication mechanisms to connection-
oriented protocols. The SASL security mechanism negotiation between client and
server is done in the clear. Once the client and the server have agreed on a common
mechanism, the connection is secure against modifying the authentication identities.

SSL and its successor, TLS, are the mechanisms commonly used in LDAP. The
Secure Socket Layer (SSL) protocol was devised to provide both authentication and
data security. It encapsulates the TCP/IP socket so that basically every TCP/IP
application can use it to secure its communication.




                                       -6-
SSL/TLS supports server authentication (client authenticates server), client
authentication (server authenticates client), or mutual authentication. In addition, it
provides for privacy by encrypting data sent over the network.

SSL/TLS uses a public key method to secure the communication and to authenticate
the counterparts of the session. This is achieved with a public/private key pair.

The simplified interchange between a client and a server negotiating an SSL/TLS
connection is illustrated here:




SSL/TLS is used to authenticate a server to a client using its certificate and its
private key and to negotiate a secret key later on used for data encryption.



Directory versus database

A directory is often described as a database, but it is a specialized database that has
characteristics that set it apart from, for example, general-purpose relational
databases. One special characteristic of directories is that in general they are
accessed (read or searched) much more often than they are updated (written).
Hundreds of people might look up an individual’s phone number, or thousands of
print clients might look up the characteristics of a particular printer. But the phone
number or printer characteristics rarely change.

Directories must be able to support high volumes of read requests, so they are
typically optimized for read access. Write access might be limited to system
administrators or to the owner of each piece of information. A general-purpose
database, on the other hand, needs to support applications such as airline
reservations and banking with high update volumes.



                                       -7-
The directory as infrastructure

A directory that is accessible by all applications is a vital part of the infrastructure
supporting a distributed system. A directory service provides a single logical view of
the users, resources, and other objects that make up a distributed system. This
allows users and applications to access network resources transparently. That is, the
system is perceived as an integrated whole, not a collection of independent parts.
Objects can be accessed by name or function without knowing low-level identifiers
such as host addresses, file server names, and e-mail addresses.

LDAP is the protocol to be used to access this common directory infrastructure. Like
HTTP (hypertext transfer protocol) and FTP (file transfer protocol), LDAP is becoming
an indispensable part of the Internet’s protocol suite.

When applications access a standard common directory that is designed in a proper
way, rather than using application-specific directories, redundant and costly
administration can be eliminated, and security risks are more controllable. The
calendar, mail, and operator notification applications can all access the same
directory to retrieve an email address. New uses for directory information will be
realized, and a synergy will develop as more applications take advantage of the
common directory.



The LDAP directory standard

LDAP defines the communication protocol between the directory client and server,
but does not define a programming interface for the client. A standardized protocol
and the availability of a common API on different platforms are the major reasons for
the wide acceptance of LDAP.

LDAP has evolved to meet the need of providing access to a common directory
infrastructure. LDAP is an open industry standard that is supported by many system
vendors on a variety of platforms. It is being incorporated into software products and
is quickly becoming the directory access protocol of choice. LDAP allows products
from different vendors on different platforms to interoperate and provide a global
directory infrastructure, much like HTTP enabled the deployment of the World Wide
Web.

A common directory infrastructure encourages new uses. The Directory Enabled
Networks (DEN) Initiative is a proposal to allow information about network
configuration, protocol information, router characteristics, and so on to be stored in
an LDAP directory. The availability of this information in a common format from
many equipment vendors will allow the intelligent management and provisioning of
network resources. These examples show the diverse uses of directory-enabled
applications supported by a common directory infrastructure accessed with LDAP.



LDAP directory products

Novell, eDirectory
Sun, Sun ONE Directory Server



                                        -8-
Netscape Directory Server
Oracle, Oracle Internet Directory
Microsoft, Active Directory
IBM, Directory Server
Open LDAP, Open LDAP
Apple Open Directory



Value for the enterprise: short-term, long-term benefits, and
ROI

Short-term benefits

The short-term benefits of directory deployments are related primarily to
administrative overhead and information quality. The fact that most enterprises have
multiple directories is no surprise, but many companies haven’t really examined how
much it costs to maintain those directories or the overall impact of inaccurate
information. The need to manage multiple directories—most of which contain the
same user and resource information—creates significant costs related to the
duplication of effort and the inaccuracy of directory information. Simply put,
companies want a single, authoritative source of accurate information. While they
can’t reduce the number of directories they have to just one, IT managers can
reduce the duplication of effort and increase the accuracy of directory information
through integration and unification efforts, which in turn save money.

Each directory a company has to maintain comes with its own setup, administration,
training, support, and maintenance operations. IT departments must hire and train
people to run those directories, and end users must access them. In other words,
each directory has its associated costs, and reducing the number of directories that
an organization has to manage can reduce costs.

A few simple calculations illustrate these savings. A company having an annual
administration costs of $360,000, if it is supporting seven directories and 35,000
individual record changes occurring annually, and if it takes an average of 15
minutes to change a directory record, can reduce the cost of directory changes to
$52,000 by consolidating its directories.

In comparison with most enterprise environments, this example is relatively simple.
It’s safe to say that all large enterprises have more than five directories. If we
consider between 15 and 30 directories, which isn’t out of line with the reality most
companies face, we get dramatically higher savings. Therefore, our example clearly
illustrates that even in a simple environment, the cost savings that a directory
integration project yield are significant. Enterprise customers can use similar
techniques to calculate the costs of maintaining the status quo, and estimating the
cost savings that they can realize from implementing an integrated enterprise
directory in their own environment. By comparing those two numbers and illustrating
the return on the directory investment, a directory proposal can usually gain
widespread support within an organization due to the significant cost savings even a
conservative estimate promises.




                                      -9-
Long-term benefits

Using an enterprise directory integration project to reduce administration costs
allows an organization to lay the foundation for long-term benefits that are harder to
quantify, but are of equal importance. As already said, directories become as
important as fundamental protocols like TCP/IP. They provide the foundation for a
new generation of applications that support e-commerce, extranet communications,
intranet collaboration, and other functions that transform business processes.
Directories also become the coordinating element in managing distributed systems
based on policies, which managers will apply and administer via the directory.
Specifically, directories will enable managers to create clear relationships between
basic user administration and policies for security, network, and systems
management, as well as business processes, allowing them to manage the whole
network environment.

Clearly, directories are evolving and cannot fully deliver on all of these promises in
an enterprise-wide fashion today. Directory products, standards, and tools must
mature to meet these goals. Developers must leverage directories more effectively in
their applications, and customers must make progress in their directory
deployments. But organizations can currently realize some of these benefits. The
longer an organization waits to start building its directory infrastructure, the longer it
will take to realize these benefits as they emerge over the next three to five years.


Security Management

Directories allow security managers to associate credentials from different
authentication mechanisms with each user’s unique directory ID. Directories can
associate both X.509 digital certificates and Kerberos passwords with a specific user,
giving managers a single place to manage and integrate credentials and security
policy. In addition, directories are the ideal foundation for single sign-on services.
Likewise, Virtual Private Networks (VPNs), firewalls, and other security services can
use the directory to authenticate users, store and apply access controls, and expose
their services to other applications. As organizations centralize important security
functions in the directory, they can save money and effort by minimizing
administration overhead and decreasing risk.


Network Management

As the DEN initiative clearly demonstrates, directories will be the foundation for
management tools that allocate bandwidth based on quality and class of service
parameters (QoS/CoS). IT organizations will be able to provision and personalize
network access using profiles and policies for groups and individual users. IT
organizations can use these QoS/CoS services to meter services for charge back to
internal customers, and to cost-justify network hardware upgrades. As organizations
leverage policy-based management, they can save money by minimizing the effort it
takes to manage the network while using corporate resources more efficiently.




                                        - 10 -
Systems Management

Increasingly, systems management tools will store policies for application and
operating system configuration preferences in the directory. Directories will enable
location independence, allowing users and applications to access resources, and get
the appropriate class of service, wherever they are. These developments make it
clear that it will be directories, not the network computer, that will rein in the costs
of desktop systems management.


E-commerce and business process applications

Directory services will be the foundation for e-commerce and extranet applications
that put business processes ―in‖ the network. Directories will allow people to
collaborate and share information, for example, both internally and externally.
Applications will use the directories as the repository for roles and capabilities,
allowing applications (and the people that use them) to find the resources they need.
Directories will also allow applications to access naming, addressing, and routing
information for the people and applications involved with any process. An enterprise
directory will also enable trust relationships between partners, suppliers, and
customers. Many enterprises will maintain extranet directories, hosting entries that
describe their partners and customers through trading profiles and policies, including
each partner’s digital certificates and other important attributes, such as capabilities,
access rights, and appropriate contacts. Until global directory replication standards
emerge, many directory managers will want to delegate the authority to manage
these entries to their partners, ensuring a higher level of data integrity.

Many enterprises using extranets for business-to-business e-commerce will also have
to issue certificates for their trading partners, especially in cases where a strong
vertical electronic marketplace doesn’t exist. Thus, directories will support the
centralized management of e-commerce applications and tight integration with
corporate security, network, and systems management policies and systems.
Without a solid directory foundation, commerce applications will not scale to the
hundreds of thousands, if not millions, of users most enterprises want to serve.


Competitive Advantage

All of these long-term benefits translate to competitive advantage. Directories will
make new applications easier to build, because they can leverage the directory and
security infrastructure instead duplicating it. Thus, organizations can re-engineer
their business processes with less pain and overhead. Lower administration costs
free resources and enable investments in other developments that can improve the
company’s business process and bottom line. Finally, the coordination of security,
network, and systems management through policy will improve security, save
money, and strengthen a company’s competitive capabilities.


Directory ROI

Organizations must consider both the short-term and long-term benefits of a
directory strategy to assess accurately the return on investment. Simply put, the


                                       - 11 -
long-term directory payback comes by combining the short-term benefits of reduced
administration costs with the long-term strategic benefits of a directory
infrastructure.

In the initial term of a directory integration project, costs will increase as an
organization invests in the directory infrastructure, cleans up and integrates
corporate data, and takes on the hard work of directory integration and unification.
But over the long term, costs will decrease as the integration pays off. The
organization will have to manage fewer directories, and an increasing number of
applications will leverage the directory infrastructure. Without such an integration
effort, costs will rise exponentially as an organization maintains an increasing
number of directories and fails to effectively leverage the overall strategic advantage
of an enterprise-wide directory infrastructure.



Directory service integration for ISP's and Hosting companies –
a case study

A directory-integrated web hosting system aims to facilitate the every-day
operations of hosting providers, ISPs, and their clients. It saves valuable
management resources by automating the time-consuming aspects of web hosting,
providing a simple and easy-to-use web interface that allows the client’s and
provider’s technical staff to maintain web hosting system from any computer with
Internet connection.
Hosting providers are using enormous number of diverse web services and products
provided by different vendors. If these services are not unified in one integrated
solution, their management, control and monitoring turns into a hard and time-
consuming task.
Bianor’s WireFlame Integrated Web Hosting System enables ISP to finally get the
features they need with enough performance to support tens of thousands of web
sites, domains and users.
WireFlame is an integrated web hosting system with two major components – a
Server System, that provides different network services, such as email, custom web
sites, file transfer, etc., and an Administration Interface, which is a unique
management application for the sales people, technical staff, and end-users enabling
them to centrally manage all their profiles and subordinates.

Key features and advantages of WireFlame Web Hosting

      Robust system - built for growth above 100,000 mail accounts, tens of
       thousands of web sites, domains, and users
      Highly available and reliable - runs on a cluster of load-balanced PC servers
      Scalable - new machines can be easily added to the cluster
      Flexible and open to new functionalities - allows easy integration of new
       modules and third-party products
      Manageable - centralized directory for all services and products
      No additional license costs - integrates the best open-source proven products
       like Apache, qmail, etc.


                                      - 12 -
      Based entirely on Linux - no additional license costs for middleware
      Multi-lingual support - English, Japanese, and other
      Remote management of accounts via secure web access
      High level of network security and monitoring
      Easy to support
      Low TOC (Total Cost of Ownership)




For Hosting Providers

WireFlame provides hosting provider's sales force a selection of predefined service
packages, which they can easily offer to their clients. Hosting packages allow flexible
customization of all features and aspects of a hosting plan, making it a swift to build
a hosting offer that is perfectly suited for every individual client's need. The package
is a kind of a wizard, which lowers creation and modification efforts by using
predefined profiles while giving the means to add or remove services and change
quotas through a simple point-and-click interface.


For Technical Staff

WireFlame integrated directory-based policy management controls which system
users have access to different resources. Access rights are grouped by role name,
and access to resources is restricted only to users who have been assigned a given
role. For example, a user who is defined as a system administrator of a certain
client's company can access only the company's properties and manage company's
internal user profiles, details, and quotas in the range of resources generally
provided to the company by the hosting provider.


For End-users

WireFlame Web Hosting System provides end-users with custom managed profiles,
web sites, email, file exchange, FTP, WebDAV, DNS, SMTP, POP3, IMAP, web mail,
mailing lists, CGI's, access management and usage statistics, network security,
backup, real-time monitoring, and a number of other integrated products and
services - sized for thousands of companies and hundreds of thousands users,
centrally managed through a web interface for every single user.

WireFlame Server System provides the following basic functionalities and services to
the Internet users, integrated through a central directory:
      Web server - User password-protected directories, SSL, Apache mod plug-ins
      DNS
      Sub domains
      File transfers – FTP, WebDAV, Web-based file exchange
      Multimedia capabilities


                                       - 13 -
      Application environments – Java, XML, ASP, Perl, Python, PHP, C/C++,
       Standard CGI packages
      Email - SMTP, POP3, IMAP, WebMail
      Mail listings
      Anti-virus and spam control
      Database – MySQL, PostgreSQL, Oracle 9i, IBM DB2, and other
      E-shops and catalogs
      Interface to payment providers
      Administration Interface
WireFlame is an open architecture system to which different software packages can
be integrated according to hosting provider and customer’s needs. Herein, we
present the basic functionality and packages of the system.



Conclusion

IT managers can demonstrate the value of, and the return on, an enterprise
directory project by quantifying the short-term benefits in terms of dollars, and
defining the long-term benefits in terms of strategic initiatives. With a well-executed
implementation plan, enterprise customers can expect a return of approximately five
times their ongoing investment, depending on the size of the network, the number of
users in the directory, and the number of directories being integrated with the
enterprise directory. Organizations can realize that return in cost savings in the
millions of dollars, primarily in the areas of administration and support. But those
savings will come only through the hard work, careful planning, and commitments
that directory projects require.



Contacts

For more information please contact:

BIANOR
5 Stratsin Str.
1407 Sofia
Bulgaria

Email: info@bianor.com
Web: www.bianor.com




                                        - 14 -