Subject: RE: More problems with OCSP

From: Alan Lloyd <[email-masked]>
Date: Thu, 26 Aug 1999 15:33:51 +1000

Sorry for the delay - can I ask what are you building this with?
Is an X.500 distributed system or LDAP servers - what are the backbone
features you are working with.

What reliability, ownership, DIT referential info and server
connectivity do you want. 

We have router DSAs etc that permit a range of backbone characteristics
(eg load balancing) - including interconnecting those free standing LDAP
servers.

I always try (in designing large scale directory systems)  address the
overall service issues, the capability requirements of the operational
directory system as input to the naming and schema strategy..Then make
this part of the operational design re DSA routers, DSA processes, DBs,
etc.

I am happy to discuss this off list.

regards (humble) alan

> -----Original Message-----
> From:	Sweigert, David 
> Sent:	Wednesday, August 25, 1999 8:28 AM
> To:	Alan Lloyd; [email-masked]'; [email-masked];
> [email-masked]
> Subject:	RE: More problems with OCSP
> 
> 
> As anyone grappling with the problem of defining a directory
> information
> tree for a multi-national company.  In other words, how do divisions
> in
> the UK and US relate in the DIT if both divisions are within one
> corporate
> organization; say MARKETING.
> 
> Would this be appropriate:
> 
> c=US
> o=GlobalCorp
> ou=Marketing
> 
> and
> 
> c=UK
> o=GlobalCorp
> ou=Marketing
> 
> 
> Any thoughts on this ?
> 
> Dave Sweigert

---

From: Robert Moskowitz <[email-masked]>
Date: Thu, 26 Aug 1999 14:06:39 -0400

At 06:28 PM 8/24/1999 -0400, Sweigert, David wrote:

If I remember correctly, GM goes by country and then function.

Chrysler went by function and then country (don't know what DCX will do).

So do what ever you want.  Either will work for your client, neither will
work for a global lookup.

>
>As anyone grappling with the problem of defining a directory information
>tree for a multi-national company.  In other words, how do divisions in
>the UK and US relate in the DIT if both divisions are within one corporate

Robert Moskowitz
ICSA
Security Interest EMail: [email-masked]

---

From: Alan Lloyd <[email-masked]>
Date: Sun, 29 Aug 1999 00:19:48 +1000

Dear all, my last response re - "what are you building this with" let me
explain.

LDAP servers - generally like their namespace to the root - the world is
theirs. This creates a few inteconnectivity problems to say the least
when one tries to group these things as a collective.
 And, if you want to have authenticated users on a multi - LDAP server
system - referrals become useless and you have to replicate everything
to everywhere.. 
So if you build a system with LDAP servers like this.. what you call
things under the root does not matter - Country can be WW or XX, Org can
be under this and a persons entry can be unique and exist as replicated
entries all over. However, an new namespace just means that each server,
just grows and grows as do the replication effort -so a wall will be hit
at some time.

If you want to build a real distributed directory system then a few
options can be taken up if LDAP/DAP accessed X.500 distributed
directories are used. In addition one builds these things knowing that
at some point in time the system will grow with other DSAs/ servers (via
DSP) or as with us subordinate LDAP servers (if OD DXserver is used).
ie these additions can have different namespace (ownership). 

So when dealing with scaleable distributed directory systems the naming
and knowledge  issues become more exact, the operational backbone issues
re multi master, caching, load balancing, alternates and fault
tolerance,etc all require consideration.

In addition the schema needs to be thought through a bit more as do the
requirements for distributed searching and domain based and subtree
based access control regimes.

I see a number of LDAP server naming approaches and schemas get put
together - "easily",  simply because the directory in this case  is
isolated. So no operational and scaling rules apply re additional
namespace and cross DSA searching. However, I have also seen this come
undone for the same reason. ie we need to connect server a with server b
and get distributed searches going and common access controls - and with
system reliability  addressed.

I think its very bad in directory system design to quote country and
organisational level name and schema design - without operational,
system and inteconnectivity issues defined. Because done in isolation -
just means that external operational, commercial and technical issues
wont be addressed.!

There are of course - some whojust want an isolated LDAP directory
server - with replicate everything to everywhere..However, there arnt
too many that want a isolated PABX - are there?

Just thoughts and regards alan

----------
From: Robert Moskowitz
To: Sweigert, David; Alan Lloyd; [email-masked]';
[email-masked]; [email-masked]
Sent: 8/27/99 4:06:39 AM
Subject: RE: More problems with OCSP

Chrysler went by function and then country (don't know what DCX will
do).

So do what ever you want.  Either will work for your client, neither
will
work for a global lookup.

information
corporate

Robert Moskowitz
ICSA