AWG - Directories

Redhat Directory Server - Return from LDAP History

Thu, 22 Sep 2005 15:26:03 -0700

When APU was to deploy our first LDAP directory service, we were looking at running both OpenLDAP and Netscape/iPlanet Directory Server. The sole reason we were going to purchase the iPlanet directory server was because it had a password synchronization mechanism with NT 4. It was a major goal to have a single username and password for all major services running on windows and unix. However, when implementation time came around, we had moved to Windows 2000, which the iPlanet directory did not yet support sychronization with.

Much time has passed...

Identifier and Directory Resources

Fri, 14 May 2004 15:16:51 -0700

Identifiers, Authentication, and Directories: Best Practices for Higher Education
A Recipe for Configuring and Operating LDAP Directories
eduPerson Object Class
MACE-Dir - the directories working group of the Middleware Architecture Committee for Education (MACE)
Internet2 Middleware Initiative
IMT Architecture Working Group's Identity Management Initiative

APU NetID Identifier Directory Considerations

Fri, 14 May 2004 15:01:33 -0700

Part of the reason for choosing NetID is to clear up some confusion around the UID identifier which has two meanings.

On Posix systems such as Unix/Linux, UID refers to User ID. OpenLDAP currently uses the UID attribute for the "Udeupa Username". This will continue to be true even after this "APU NetID" name change.

UID also stands for Unique Identifier. This value appears as the first field in the Distinguished Name (DN) in LDAP. The DN represents the location of a record in the heirarchical Directory Information Tree (DIT). APU is using the same value for both the DN and the attribute. For example:

dn: uid=joestudent,ou=Students,ou=People,dc=apu,dc=edu
uid: joestudent

According to Identifiers, Best Practices for Higher Education, the UID should be distinctly different than the NetID.

This ID is centrally provided, perhaps with distributed online clients. It is assigned to all current active users of campus electronic resources. The UID should be non-revokable and non-reassignable; hence it needs a large capacity (32 bits minimum). All other identifiers should be either directly or indirectly linked to the UID.

The identifier most closely associated with these qualities is our "APU ID Number", not the NetID. The reasons for using a value in the DN that won't change, is because changing the DN is not efficient. It requires, in most cases, removing a persons entire entry and re-adding it. It also requires changing all group memberships for that user, which are associated by DN. The fundamental concept is that an active APU person's DN should never need to be changed. As long as they are affiliated with APU their "LDAP Address" should not change. This is also the reason why the Internet2 Directories Working Group is promoting the use of a "flat" ou=People tree, not desiring to represent affiliation via the person's location in the DIT. A person is rather referenced in groups by their "permanent DN" throughout the directory.