In this chapter, we will introduce works related to our research. First, we will

Transcription

1 Chapter 2 Related Works In this chapter, we will introduce works related to our research. First, we will present the basic concept of directory service and Lightweight Directory Access Protocol (LDAP). Next, we will describe the LDAP Proxy architecture and introduce the vendors of LDAP Proxies. 2.1 Directory Service A directory service is a service that provides a directory for people to search for information quickly. A directory is a type of database that contains descriptive information of entries, and is optimized for searching and retrieving structured data. The entries in the directory are attribute-based and are generally read much more often then written. A directory usually offers a static view of the data, and it has simple updates without transactions. These special characteristics make directories suitable for storing static information, such as personal profile, network resource, access control data, or configuration information. To extend the directory s capability of storing various types of information, schema can be used to describe the sequence of fields in the directory. With the advent of computer networks, directory services can extend their services over the network. When considering directory services over the network, we can identify two kinds of directory services. Local directory services provide services CHAPTER 2 RELATED WORKS 5

2 to a restricted context, such as the UNIX finger service on a single machine. Global directory services provide services over the global network, i.e., the Internet, with services like the DNS service. These services are usually distributed, cooperate multiple machines, and define a uniform namespace that gives an identical view of the data no matter where people access the service. The distributed and cooperative nature of these directory services also demands that the directory servers have the ability to communicate with each other using a common protocol and directory representation. The Lightweight Directory Access Protocol (LDAP) [1][2][3] is such an open-standard directory service that is widely accepted and vendor supported. 2.2 LDAP LDAP is a set of protocols for accessing information directories. It is based on a client-server model and is a simplification of the X.500 directory access protocol (DAP)[10]. Unlike X.500, it supports TCP/IP. LDAP consists mainly of three parts: the data format defines how the directory information is stored and recalled, the protocol defines how clients and servers interact with each other, and the API defines how programs can interact with an LDAP server The Data Format Each piece of data stored in the LDAP server is called an entry, an object, or an object entry. An LDAP entry is a collection of attributes and has an unambiguous name called a distinguished name (DN). Each part of a DN is called a relative distinguished name (RDN). Each attribute has a type and one or more values. The CHAPTER 2 RELATED WORKS 6

3 types are typically mnemonic strings, like cn for common name and ou for organizational unit. The values depend on what type of attribute it is and can be either text or binary. An object class defines what object attributes are required and what are optional. LDAP entries are ordered in a hierarchical format, and the hierarchy is defined by a particular object class. The object classes are defined in RFC 2556 [5]. An example data format is shown below: ( NAME serialnumber EQUALITY caseignorematch SUBSTR caseignoresubstringsmatch SYNTAX {64} ) In this example, is an object identifier, referred to as an OID. OIDs are used to help identify object classes and their attributes in a unique fashion. According to the OID syntax, we know where particular objects or attributes are originated. For example, in the OID above refers to the IETF defined objects and attributes. Companies can get their own OID from the Internet Assigned Numbers Authority (IANA) at The specification of the attributes is given in RFC-1778 [2]. As mentioned, the data in an LDAP server is organized in a hierarchical format. A basic LDAP hierarchy is illustrated in Figure 1; the top level in the hierarchy is called the domain. There can be several domains in an LDAP implementation. Typically, the top-level domain will just be the root of the organization or organizations that a particular company manages. The branches are in the form of organizational units, which are abbreviated to ou. An entry that is not a domain or an organizational unit is called a leaf. Domains, organizational units and every type of information that is contained in the LDAP server must have a unique entry; these CHAPTER 2 RELATED WORKS 7

4 entries must be a member of a particular object class and a collection of name-value pairs. Figure 1 A hierarchical structure of the directory data in an LDAP server Figure 2 An example directory under the Netscape Directory Server Consider the example shown in Figure 2. It is an example directory under the Netscape Directory Server [11], which is an LDAP server developed by the Netscape. In this LDAP server, the domain is cs.nthu.edu.tw, its branches are organization units (ou) in the name-value form of ou=prople, ou=groups, etc. Below the ou are entries with the distinguished names (dn) of uid=gchen, ou=people, and o=cs.nthu.edu.tw. Each LDAP server defines the object classes and the object hierarchy in a schema. The schema is the blueprint of the LDAP server; it defines the format of the records in the directory. CHAPTER 2 RELATED WORKS 8

5 2.2.2 The Protocol LDAP uses the TCP/IP protocol for its basic network communication. Since LDAP data are primarily text based and texts do not take up much space, the message contents can easily be compressed. When a client interacts with an LDAP server, it goes through three basic steps. First, the client connects to the server. Second, it performs a series of operations with the server, and third it disconnects from the server. LDAP defines six basic operations: binding to the server, searching the server, comparing entries, adding an entry to the server, modifying existing entries, and removing an entry from the server. The most important operation is search operation, It involves a sequence of operations ldap_init, ldap_bind, ldap_search, amd ldap_unbind shown in the Figure 8. Figure 8 a sequence of steps in a simple LDAP search operation ldap_init open initializes the LDAP library, opens a connection to the directory server, and returns a session handle for future use. The ldap-bind operation is responsible for client authentication. The bind operation allows a client to identify itself to the directory server by using a DN and some authentication credentials (password or CHAPTER 2 RELATED WORKS 9

6 other information). LDAP supports a variety of authentication methods. We use password authentication in our experiments. When a bind operation is successfully completed, the directory server remembers the new identity until another bind is done or the LDAP session is terminated by calling ldap_unbind. The ldap_search operation initiates a LDAP search by specifying the criteria that entries fitting in the associated filter could be returned. We develop a search filter generation tools in our experiments. When all the LDAP operations are complete, a LDAP session is terminated by using ldap_unbind. LDAP also provides three important services. The referral service is designed to allow the LDAP servers to link to each other. Through this service, if a server cannot satisfy a request, the client will be referred to another server for possible results. The replication service enables administrators to replicate the directory contents to multiple servers in order to provide a high-availability service. That means, if one server goes down, then at least one other server will still be running and can provide the contents. Having multiple replicated servers also can load-balance the requests, which can speed up the directory service. Finally, the security service lets administrators to protect the data in the server. LDAP server supports a wide range of security/encryption protocols, such as the Simple Authentication and Security Layer (SASL) and Secure Socket Layer (SSL) encryption. It is possible to encrypt all transactions with an LDAP server, while ensuring that the clients are as they have claimed. It is also easier for the administrators to keep track of who is using the network and who has access to the network. The data in the server is protected with Access Control Lists and client binding. CHAPTER 2 RELATED WORKS 10

7 2.2.3 The APIs One major reason that has led to the quick development of LDAP is the ease of development of LDAP clients through a set of well-defined APIs. Until now, there are several APIs for programmers to use, such as Netscape SDKs, Netscape C, Java and Perl SDK Internals, and Sun and Microsoft s LDAP SDKs. [5] 2.3 LDAP Proxy An LDAP proxy [7][8][9] sits between a client and its LDAP servers. When the client sends a request to the LDAP server, the request is routed to the LDAP proxy first. The LDAP proxy processes this request according to predefined rules before passes it on to the LDAP server. For example, when a user connects to the LDAP proxy, the LDAP proxy gets the user information from the user binding operation. This information includes user DN, request content, and operation type. According to this information and administrator predefined rules, the LDAP proxy then checks query syntax, and may rewrite, merge, and filter the query. These query manipulations are all processed at real-time. Major functions executed in the LDAP Proxy include single login, character set mapping, detect fail-over, and maintain load balancing. An LDAP proxy can enforce the policy that certain queries can only access certain attributes or return results containing certain attributes. It also can provide some form of control over the type of operations that the client can execute against the directory. Like LDAP servers, most LDAP proxies support protocol encryption for security purpose. In general, they employ the Secure Sockets Layer (SSL) [6] protocol, which is widely used on the Internet as well as other applications or servers. CHAPTER 2 RELATED WORKS 11

8 LDAP proxies have the ability to chain several LDAP servers together and manage them as a whole. Thus, they can distribute the received requests to those servers in order to perform load balancing. This is shown in Figure 3. Furthermore, LDAP proxies can periodically detect whether back-end servers are alive. When they find that one LDAP server is failed, they will redirect the requests which are send to this server to other workable servers and notify the administrator to repair that server. This failover operation is shown in Figure 4. Searches or Updates Load Balancing/Failover LDAP Proxy Servers Forward Operations to a Server in a Server Group Master or Slave Servers Figure 3 The LDAP proxy can perform load balancing Searches or Updates Load Balancing/Failover Proxy Servers Forward Operations to a Server in a Server Group Masters or Slaves Figure 4 The LDAP proxy can perform failover In summary, an LDAP proxy transparently directs and transforms queries to the CHAPTER 2 RELATED WORKS 12

9 LDAP servers. It can filter responses that are replied back to the client. It may support different levels of security in authentication and authorization and has the ability to perform load balance and failover. 2.4 Vendors of LDAP Proxy Currently there are three companies supplying standalone LDAP proxy services [7][8][9]. Each LDAP proxy product offers the same basic functionality of accepting multiple LDAP client requests and returning the query results from one or more LDAP servers. In this section, we will briefly describe these LDAP proxy products Innosoft LDAP Proxy Server (ILPS) ILPS is developed from the Innosoft International, which is available for NT and Sun Solaris, and supports LDAPv2 and LDAPv3 [7]. Administrators manage ILPS through.ini configuration files. ILPS also offers to use LDAP Data Interchange Format (LDIP) files for configuration. ILPS provides the ability to change attribute naming, set attribute to query, and set attribute to return in a result set. However, it does not provide any method for transforming data as it passes through the proxy. ILPS manages the referral on behalf of the client, ignores the referral, or passes the referral back to the client. Innosoft also announces that ILPS can provide automatic load balancing among multiple LDAP servers and transparent failover for high-availability directory services. ILPS s other features include support for any LDAP server or LDAP-based X.500 DSA, support for the Internet s Simple Authentication and Security Layer (SASL), and provision of centralized management within distributed environments by chaining operations to LDAP servers located CHAPTER 2 RELATED WORKS 13

10 behind the corporate firewall MaxWare LDAP Proxy Server (MLPS) MLPS is the only vendor to provide VBScript capability to manipulate data as it passes through the proxy [8]. It provides a simple GUI to let administrators to maintain servers easily. The proxy runs as an application, not as a service, which might make implement difficult for some designers. MLPS uses groups to manage permission for viewing servers. The server bases groups on the IP address and LDAP credentials that the proxy passes from the client. MLPS s other features include carrying out all necessary schema mapping, providing mechanisms for advanced access control, performing external authentication, and offering extensive configuration possibilities and statistics Directory Boundary Agent (DBA) DBA is available on both NT and Sun Solaris [9]. It enables organizations to publish useful corporate information from their directory while protecting more sensitive data from unwanted access and providing configurable user restrictions and filter implementation. DBA also provides protection at the domain boundary, supports security controls that determine who can access the directory and at what level, determines which operations the user can perform, protects sensitive data from being viewed at the branch level, and allows for single point of administrative control. CHAPTER 2 RELATED WORKS 14