Subject: The case against directories

From: "Anders Rundgren" <[email-masked]>
Date: Fri, 21 Mar 2003 09:21:05 +0100

I would like to add a few things to what Phillip Hallam-Baker of
VeriSign wrote about directories as an obstacle to PKI deployment.

Many  PKI experts are involved in huge public-sector-driven projects,
that are based on establishing directory interoperability between
organizations.  At first sight this looks like a great idea but digging
a bit further, you soon note that this is not a universal solution but
rather a dead end.

Directory problem issues 
1. Technical.  Unifying schemas + firewall issues
2. Internal information  (including employment) is generally not public
3. The level of openness depends on who is asking
4. Directories represent just one way to organize data

But, there is no reason to despair, as there are work-arounds that
properly addresses all these issues:

Using authentication systems like OASIS' SAML, organizations can
(through their employees), authenticate to each others' intranets and
through this get access to exactly the information they should have
and in a format that make sense.  The latter may be a directory tree,
a PDF-file, a database listing, an HTML form, etc.  

Unlike directory systems, SAML allows secure access to any kind
of active or passive information source, including purchasing and
work-flow systems.

All using the truly universal Internet browser interface.

For machine-to-machine (=automated) access to external information,
specialized Web Services seems to be a much more extensible route
than directories, as the former introduces no restrictions on data.

Anders Rundgren
Independent consultant PKI and secure e-business

---

From: Peter Gietz <[email-masked]>
Date: Fri, 28 Mar 2003 12:55:50 +0100

Yet another thread against directories. I wonder when "cases 
against XML" will be issued after we have found yet another 
new technology that markets well.

Please see my commenst inline:

Anders Rundgren wrote:
> VeriSign wrote about directories as an obstacle to PKI deployment
> 

As already has been stated, the problems are mostly 
organizational than technical.

Even if you don't like it, directory supported PKI is being 
more and more implemented. Look at what governments have 
been and will in future be putting effort to provide PKI as 
infrastructure to the citizens. This is happening in on both 
sides of the Atlantic. Fedbridge and Canada as well as in EU 
legislation and a lot of European countries. I am not very 
familiar with other parts of the world in this respect.

Banks and other big companies are deploying directories for 
PKI as well. Are all of them on a dead end road?

> 1. Technical.  Unifying schemas + firewall issues

There is commonly accepted schema for phase one (one user 
has one or few certs) that is in use and works. Phase two 
(lots of certs and functionality to provide searches within 
the cert information is currently in discussion for phase 
two where people have lots of certs, including attribute 
certificates.

A firewall that only permits HTTP ports is nice, but since 
more and more things gets tunneled within HTTP they get more 
and more useless. On the contrary to permit special ports 
for very clear defined purposes like directory communication 
seems to be much nicer.

> 2. Internal information  (including employment) is generally not public

No problem for directories, since you have well established 
and good working authentication and access control 
mechanisms, so everyone can define who is allowed to see the 
certs.

As said before: this organizational problem applies top all 
technical solutions, only that directories are quite good in 
providing help (and directory experts are often privacy 
experts as well)

> 3. The level of openness depends on who is asking

Yes see remarks on 2.

> 4. Directories represent just one way to organize data

Yes, and as I said before, ther might be scenarios in which 
XML/Web Services technology are more appropriate (I am not 
making a "case against XML"). Still I know of a lot os 
scenarios, where existing, well established technology is 
better for production services.

> of active or passive information source, including purchasing and

SAML is a good but complex means for communicating 
authorizations ans assertions, it is not a whole middleware 
infrastructure.

> All using the truly universal Internet browser interface.

Do you know that a very high percentage of directory usage 
goes through a Web-to-LDAP gateway?

> than directories, as the former introduces no restrictions on data.

And thus provide a lot of interoperability issues. WSDL/UDDI 
is good for providing information about the existance and 
function of services. You will  end up in schema 
standardization nonetheless to provide interop.

Cheers,

Peter

-- 
_______________________________________________________________________

Peter Gietz (CEO)
DAASI International GmbH                phone: +49 7071 2970336
Wilhelmstr. 106                         Fax:   +49 7071 295114
D-72074 Tübingen                        email: 
[email-masked]
Germany                                 Web:   www.daasi.de

Directory Applications for Advanced Security and Information 
Management
_______________________________________________________________________