1. Directory Architecture Plans and Status UNITS Meeting Feb 2005 Tom Board, Director, ISA

2. Agenda Summary Motivators Progression of configurations LDAP Registry versus White Pages Technical issues Policies and unresolved issues

3. Summary Directory architecture is driven by application technologies and privacy rules Past configurations were not friendly to applications and couldn’t enforce privacy Future directories will expose information under community rules (NU policies) The industry continues to change directory services and we will need to adapt

4. Motivators 1.Reduce the cost to incorporate new technologies and software into the University 2.Ensure compliance with Federal laws governing privacy of information 3.Enforce elective privacy decisions by individuals under University policies

5. Progression of Directory Configurations

6. Circa 1995 Configuration

7. Server & Outlook Introductions

8. AD Introduction

9. Current Configuration

10. August 2005 Configuration

11. Windows 2003 Server R2

12. LDAP Registry vs. White Pages Registry is provisioned by SNAP –All access is reviewed and approved –Each application has a DN that defines access rules and items returned –No anonymous binds –All binding IP addresses known to the firewall

13. LDAP Registry vs. White Pages White Pages is replicated from the Registry –Web directory page is primary access –Anonymous binds must be allowed Content defined by source administrators Content will always be a subset of Web page –On-campus versus off-campus returns

14. Technical Issues Resolving the multiple identity problem Migrating to supportable provisioning of second-tier directories Defining the role of a central AD forest Deploying Shibboleth and Liberty Migrating to Windows Server 2003 AD R2 and federated authentication within NU

15. Existing Policies Single-forest-per-division architecture Handling of profile and locator information (in progress) –Source control over second-tier directories

16. Outstanding Policy Issues Who is represented in directories? What data items will be present for persons and when will they be exposed? When should privacy elections yield to: –a University academic system that is central to a student’s experience? –the University’s responsibility for personal safety?

17. Forthcoming Visible Changes Restricting punctuation in alias to hyphen, period, and underscore (April 3 rd ?) Change from server provisioning to AD synchronization (June?) Novell e-directory provisioning (June?) LDAP authenticators change to “registry.northwestern.edu” after HA configuration is completed (July?)

18. Questions?