Overview of Enterprise Directory Architecture

Original author: Beth Mercer - 20081031

The University of Alaska Enterprise Directory and Authentication Service are comprised of the following four architectural components:

• EDIR Directories
• EDIR "registry"
• Web Gateways
• Equalizer

EDIR Directory : SUN LDAP iPlanet Directories

iplanet UNIX account

source of information for web gateways source of identity for authentication service enforces uniqueness

(BannerID, UASystemID, UASystemLegacyID, UID and mailAlternateAddress)

enforces limited password logic

(age, length, composition, reuse)

contains plugin for kerberos authentication

3 instances; Test, Prep, Prod on 4 servers; eklutna, egegik, edgar, elias (soon to be 5th server; elfin)

EDIR "registry" : Oracle Databases

sxldap UNIX account and OPS$SXLDAP schema

superset of directory data reconciliation of entities from various systems of origin

(primarily Banner)

enforces business logic

3 instances; RPTT, RPTQ, RPTS on 1 server; summit

Web Gateways

ldapgw UNIX account for EDIR/AUTHSERV

AUTHSERV: web authentication service and interface to security related functions; also interface to kerberos password/account management for kerberized directory records (e.g. password changes/resets, locking/unlocking accounts, creating guest accounts, etc.)

EDIR: white pages and interface to self service updates

iplanet UNIX account for UPDATE

UPDATE: interface called by both EDIR and AUTHSERV to perform directory updates

3 instances each; Test, Prep, PROD on 4 servers; eklutna, egegik, edgar, elias (soon to be 5th server; elfin)

Equalizer

load balancing for DNS names

edirtest.alaska.edu edirprep.alaska.edu edir.alaska.edu

authservtest.alaska.edu authservprep.alaska.edu authserv.alaska.edu

email-lookup.alaska.edu

for http/https ports for ldap/ldaps ports

Historical Use of Kerberos

NOTE: Originally Kerberos synchronized LDAP password information with OIT. That implementation is no longer current and not maintained in anyway. At that time the Kerberos Realm consisted of:

• Synchronization Command: oitsynch UNIX account

• A password store behind iPlanet Directory
• A directory plugin implements kerberos authentication during directory bind
• An UPDATE interface behind AUTHSERV implements kerberos password reset/change/lock/unlock functionality
• 3 realms: test.alaska.edu, prep.alaska.edu, prod.alaska.edu - 1 each on 3 servers: cisca, cobalt, cupola

######################################################## LEGACY CHANGE HISTORY - NOTE: All subsequent changes are recorded in TracWiki ######################################################## 20081031 elm corrected typos