World Library  
Flag as Inappropriate
Email this Article

Directory service

Article Id: WHEBN0000334641
Reproduction Date:

Title: Directory service  
Author: World Heritage Encyclopedia
Language: English
Subject: Active Directory, Java Naming and Directory Interface, Name server, OpenDS, Identity management
Collection: Computer Access Control, Computer Access Control Protocols, Directory Services
Publisher: World Heritage Encyclopedia
Publication
Date:
 

Directory service

A directory service or name service, maps the names of network resources to their respective network addresses. With the name service type of directory, a user does not have to remember the physical address of a network resource; providing a name locates the resource. Each resource on the network is considered an object on the directory server. Information about a particular resource is stored as attributes of that object. Information within objects can be made secure so that only users with the available permissions are able to access it. More sophisticated directories are designed with namespaces as Subscribers, Services, Devices, Entitlements, Preferences, Content and so on. This design process is highly related to Identity management.

A directory service defines the namespace for the network. A namespace in this context is the term that is used to hold one or more objects as named entries. The directory design process normally has a set of rules that determine how network resources are named and identified. The rules specify that the names be unique and unambiguous. In X.500 (the directory service standards) and LDAP the name is called the Distinguished name (DN) and refers to a collection of attributes (relative distinguished names) that make up the name of a directory entry.

A directory service is a shared information infrastructure for locating, managing, administering, and organizing common items and network resources, which can include volumes, folders, files, printers, users, groups, devices, telephone numbers and other objects. A directory service is an important component of a NOS (Network Operating System). In the more complex cases a directory service is the central information repository for a Service Delivery Platform. For example, looking up "computers" using a directory service might yield a list of available computers and information for accessing them.

Replication and Distribution have very distinct meanings in the design and management of a directory service. The term replication is used to indicate that the same directory namespace (the same objects) are copied to another directory server for redundancy and throughput reasons. The replicated namespace is governed by the same authority. The term distribution is used to indicate that multiple directory servers, that hold different namespaces, are interconnected to form a distributed directory service. Each distinct namespace can be governed by different authorities.

Contents

  • Comparison with relational databases 1
  • Implementations of directory services 2
    • LDAP implementations 2.1
  • Using name services 3
    • Unix OSs 3.1
  • See also 4
  • Notes 5
  • References 6

Comparison with relational databases

Several things distinguish a traditional directory service from a typical relational database. Of course there are exceptions, but in general:

  • directory information is read more often than it is written; this makes features related to transactions and rollback less important.
  • data can be redundant if it helps performance.

Directory schemas are defined as object classes, attributes, name bindings and knowledge (namespaces), where an object class has:

  • Must - attributes that each of its instances must have
  • May - attributes that can be defined for an instance, but can be omitted with the absence treated somewhat like NULL in a relational database
  • Attributes are sometimes multi-valued allowing multiple naming attributes at one level such as machine type and serial number concatenated or multiple phone numbers for "work phone".
  • Attributes and object classes are standardized throughout the industry and formally registered with the IANA for their object ID. Therefore, directory applications seek to reuse much of the standard classes and attributes to maximize the benefit of existing directory server software.
  • Object instances are slotted into namespaces. That is, each object class inherits from its parent object class (and ultimately from the root of the hierarchy) adding attributes to the must/may list.
  • Directory services are often a central component in the security design of an IT system and have a correspondingly fine granularity regarding access control: who may operate in which manner on what information. Also see: ACLs

Implementations of directory services

Directory services were part of an ISO came up with a set of standards - X.500, for directory services, initially to support the requirements of inter-carrier electronic messaging and network name lookup. The Lightweight Directory Access Protocol, LDAP, is based on the directory information services of X.500, but uses the TCP/IP stack and a string encoding scheme of the X.500 Directory Access Protocol (DAP), giving it more relevance on the Internet.

There have been numerous forms of directory service implementations from different vendors. Systems developed before the advent of X.500 include:

  • Domain Name System: (DNS), the first directory service on the Internet, which is still used everywhere today.
  • Hesiod: was based on DNS and used at MIT's Project Athena.
  • Network Information Service: (NIS), originally named Yellow Pages (YP), was Sun Microsystems' implementation of a directory service for Unix network environments. It served a similar role as Hesiod.
  • NetInfo: was developed by NeXT in the late 1980s for NEXTSTEP. After being acquired by Apple, it was released as open source and used as the directory service for Mac OS X before being deprecated in favor of the LDAP-based Open Directory. Support for NetInfo was completely removed with the release of 10.5 Leopard.
  • Banyan VINES: was the first scalable directory services offering.
  • NT Domains: was developed by Microsoft to provide directory services for Windows machines prior to the release of the LDAP-based Active Directory in Windows 2000. Windows Vista continues to support NT Domains, but only after relaxing the minimum authentication protocols it supports.

LDAP implementations

Among the LDAP/X.500 based implementations are:

There are also plenty of open-source tools to create directory services, including OpenLDAP and the Kerberos protocol, and Samba software, which can act as a Windows Domain Controller with Kerberos and LDAP backends. Administration is done using GOsa or Samba provided SWAT.

Using name services

Unix OSs

Name services on Unix systems are typically configured through nsswitch.conf. Information from name services can be retrieved using getent.

See also

Notes

  1. ^ [2] Archived October 15, 2007 at the Wayback Machine
  2. ^ "Oracle and Sun". Sun.com. 2010-09-07. Retrieved 2012-01-09. 
  3. ^ "Java.net". Opends.dev.java.net. Retrieved 2012-01-09. 

References

  • Carter, Gerald (2003). LDAP System Administration.  
This article was sourced from Creative Commons Attribution-ShareAlike License; additional terms may apply. World Heritage Encyclopedia content is assembled from numerous content providers, Open Access Publishing, and in compliance with The Fair Access to Science and Technology Research Act (FASTR), Wikimedia Foundation, Inc., Public Library of Science, The Encyclopedia of Life, Open Book Publishers (OBP), PubMed, U.S. National Library of Medicine, National Center for Biotechnology Information, U.S. National Library of Medicine, National Institutes of Health (NIH), U.S. Department of Health & Human Services, and USA.gov, which sources content from all federal, state, local, tribal, and territorial government publication portals (.gov, .mil, .edu). Funding for USA.gov and content contributors is made possible from the U.S. Congress, E-Government Act of 2002.
 
Crowd sourced content that is contributed to World Heritage Encyclopedia is peer reviewed and edited by our editorial staff to ensure quality scholarly research articles.
 
By using this site, you agree to the Terms of Use and Privacy Policy. World Heritage Encyclopedia™ is a registered trademark of the World Public Library Association, a non-profit organization.
 


Copyright © World Library Foundation. All rights reserved. eBooks from Project Gutenberg are sponsored by the World Library Foundation,
a 501c(4) Member's Support Non-Profit Organization, and is NOT affiliated with any governmental agency or department.