1. May 12, 1999Common Solutions Group, DS Workshop1 Directory Design & Operations at Princeton University Michael R. Gettes Collaboration Services Group (CSG) Enterprise Services Directorate, CIT Common Solutions Group Directory Service/Schema Design Workshop May, 1999

2. May 12, 1999Common Solutions Group, DS Workshop2 Problems to solve Multiple Name Spaces Operational Data vs. Phonebook Modern Apps Directory Enabled Schema Design and Data Mapping Proper Schema Usage vs. Reality Operations: Replication, Access, Application Reqs, Performance, Etc.

3. May 12, 1999Common Solutions Group, DS Workshop3 Multiple Name Spaces Unix, Novell, NT, VM/MVS, E-Mail/Lists Need to Unify Name Space before really able to leverage a central directory Unified 3/99; took 4 months to do –Includes 2100 ListProc list addresses LDAP went “production” 3/98, install 6/97 Now looking at central userid mgmt with LDAP instead of homegrown glue.

4. May 12, 1999Common Solutions Group, DS Workshop4 Operational vs. View Only Operational –E-mail access & Routing, Web Auth, Proxy Svcs, Certificates - a wee bit View Only –CSO before, CSO2LDAP now View Only - NOT –No Rules, No Control –Fight the Future?

5. May 12, 1999Common Solutions Group, DS Workshop5 Schema Design @ Princeton Keep CSO attributes alive, how far? Use what popular apps expect –Netscape, IE/Outlook Make LDAP enabled apps work –Netscape Messaging Server only, at the time NIS & NT user management? These schemas are not well defined. Sun v. padl How did we do? Quite well, of course!

6. May 12, 1999Common Solutions Group, DS Workshop6 Schema Design @ Princeton Proper Schema vs. Reality –E-mail routing (Sendmail) vs. NSMS attribute function overload –objectclass: puPerson (superior is inetorgperson) –like, can you relate? universityid/ref to solve multi-ids –Tracking: Why a DN exists, who did last

7. May 12, 1999Common Solutions Group, DS Workshop7 Schema Design @ Princeton Princeton Attributes defined to Netscape Directory Server Princeton Attributes Netscape Search and Sample LDIF Netscape SearchSample LDIF What’s in a DN? –Cn=name (addr),o=,c= no OU! But ou defined. Multiple locations? DN’s are just that, not to be parsed. –Wouldn’t that be nice?

8. May 12, 1999Common Solutions Group, DS Workshop8 Resources Michael Gettes and Lee Varian –little if any interaction with others given data control sensitivities and most issues worked out previously because Lee generated the printed campus phonebook, permission not needed. no $$, no formal plan, no new policy –Almost invisible, therefore successful

9. May 12, 1999Common Solutions Group, DS Workshop9 Operations Mainframe (VM/CMS) bulk mgmt 1 supplier + 3 consumers Last user visible failure - CSG 1/99 Netscape DS 3.12 Solaris PerLDAP scripting very powerful –All ops on-line, NO DOWNTIME!!! Web interface to LDAP https://directory.Princeton.EDU FOR MORE INFO...

10. May 12, 1999Common Solutions Group, DS Workshop10 Operations: NSMS & Sendmail E-Mail Replica –pbind to single cpu, nice to high priority –4000 ops per minute - NSMS inefficient –100MB memory cache for 9000 users –Failover works for online repairs –Replica Monitoring and Notification NSDIRSECUG Mailing List: dirsec-request@nsdirsecug.org FOR MORE INFO...

11. May 12, 1999Common Solutions Group, DS Workshop11 Operations: General 28,000 DNs - 80MB DB, 22MB ldif Communicator configured for multiple servers Backups - On-line LDIF dumps 1/hr –no good solution for backing up LDAP Few Directory Managers (5) Help Desk has some privs for quick support to users - access lists

12. May 12, 1999Common Solutions Group, DS Workshop12 Operations: General Access Lists –What can users change? –What do Dir Mgrs change? –Audit Limits –500 max entries returned (not dumper) –near 0 look-through limit (values that have ‘*’ in them cause problems).

13. May 12, 1999Common Solutions Group, DS Workshop13 Operations: Mailing Lists 2100 Listproc Lists defined to LDAP for sendmail routing, automatically Sendmail routes using DN which can see the lists Would like to have Listproc keep list subscribers or obtain lists from group definitions in LDAP (merged groups).

14. May 12, 1999Common Solutions Group, DS Workshop14 Operations: Sendmail 8.9.3/8.10 Based on work by Stanford Princeton extended support for looking up multiple attrs and returning multiple addresses. Princeton changes available in 8.10 May 4, 1999: Moved all.forward files into LDAP, implementation by Curt Hillegas

15. May 12, 1999Common Solutions Group, DS Workshop15 Online Demo: IF Possible Https://directory.Princeton.EDU Manage Mail Account Replica Monitoring Kerberos Backend Authentication let the firestorm begin!