LDAP: Synchronizing LDAP Information CNS 4650 Fall 2004 Rev. 2

Data Flow Management Three approaches to managing data flow Replication File export/import Scripting

Replication Exactly duplicating data between directories Usually used for scalability, performance, redundancy Currently replication in LDAP is not standardized LDUP is a proposed standard Drawback Replication is not always the best thing

Replication

File Export/Import Manual process Usually used for migration Export file from server Import in to different server Drawback Delays of the manual process

File Import/Export

Scripting Use of languages like PERL, Python, etc. Access, transform, update information from one directory to another

Data Flow Analysis Analysis should be done before performing synchronization or migration Should not just do “Replication” for synchronization More issues then just “moving” entries

Schema Mapping Data stores have different attribute types or object classes Example: OpenLDAP, Active Directory Example Active Directory uses sAMAccountName for user name OpenLDAP does not Schema mapping would need to be made so that uid in OpenLDAP is equivlent to sAMAccountName

Determining Authoritative Source Migrating one data store to another One authoritative source Synchronization Multiple sources of authority Authority can be based on ownership of attribute Requires evaluation of all directories and processes for a organization

Determining Authoritative Source Synchronization Example Human Resources Database authority Name Department Job Title Directory authority address Facilities Database authority Telephone Location This example assumes that all users have a standardized username

Determining Authoritative Source

Data Transformation Convert data in to the format needed by receiving data store Example Timestamps

Namespace Translation Most likely namespaces are different between two servers LDAP to LDAP is relatively easy Mostly matter of changing root namespace Other data stores are more difficult Example: SQL database do not offer a hierarchy naming structure The administrator must derive the DN from other information Example: Department, Location, etc.

Interchage Formats LDIF DSML