Subject: LDAP or RDBMS for policy storage?

From: Atul Jain <[email-masked]>
Date: Tue, 03 Aug 1999 10:27:01 +0530

Hi,

My question is as what is better suited for policy storage: LDAP
directory or RDBMS?
The drafts in working group and the discussion in the mailing list
suggest that LDAP should be used for policy storage.

Following are some pros and cons of storing data in LDAP vs. RDBMS:
Pros:
-----
· This working group has given a standard LDAP schema for policies.
· Conforming to the LDAP schema makes the policy database standards
compliant which can then be read by any third party LDAP client.
· LDAP is optimized for few writes and lots of reads. This model suits
for polcies storage which will not be modified very often but may be
read very often.
· Most of the enterprises may already have an LDAP directory which they
may be using for storing user information etc. So that directory can be
enhanced to store the policies also.

Cons:
------
· LDAP does not have transaction support. Which makes it difficult to
maintain data consistency when multiple admnistrators are modifying the
policies in an organization.
This deficiency itself may decide one to choose and RDBMS rather than
LDAP directory. Any comments?

Regards
Atul

--
*****************************************
Atul Jain
Duet Technologies(I) Pvt. Ltd.
SDF #B1, NEPZ, Noida (U.P.) - 201305
India
Phone(Office): +(91)-(1191)-567001 to 567005
Phone(Home):   +(91)-(1191)-541919
mailto:[email-masked]
*****************************************

---

From: Michael Richardson <[email-masked]>
Date: Tue, 03 Aug 1999 11:49:46 -0400

>>>>> "Atul" == Atul Jain <[email-masked]> writes:
    Atul> My question is as what is better suited for policy storage: LDAP
    Atul> directory or RDBMS?  The drafts in working group and the discussion
    Atul> in the mailing list suggest that LDAP should be used for policy
    Atul> storage.

  Neither. Both.
  The Policy WG is not supposed to be storage centric. 

   :!mcr!:            |  Solidum Systems Corporation, http://www.solidum.com
   Michael Richardson |For a better connected world,where data flows faster<tm>
 Personal: <A HREF="http://www.sandelman.ottawa.on.ca/People/Michael_Richardson/Bio.html">[email-masked]</A>. PGP key available.
 Corporate: <A HREF="mailto:[email-masked]">[email-masked]</A>.

---

From: Randy Bush <[email-masked]>
Date: Tue, 3 Aug 1999 09:35:18 -0700 (PDT)

> The Policy WG is not supposed to be storage centric.

please explain how this relates to statements i thought i heard that the
actual definition of the policy would be the ldap interface to it.

randy

---

From: "Ryan Moats" <[email-masked]>
Date: Tue, 3 Aug 1999 12:15:37 -0500

| > The Policy WG is not supposed to be storage centric.
| 
| please explain how this relates to statements i thought i heard that the
| actual definition of the policy would be the ldap interface to it.
| 
| randy

Maybe I'm confused (I get that way often), but I thought that the
information model was supposed to be storage agnostic and the LDAP
schema a mapping of the info model.  The assumption (I don't know if
it is every explicitly stated anywhere) is that there can be other
mappings for other storage systems.  Another assumption (of mine) is that
eventually another mapping document would be written.  Note, I'm not
volunteering to write that other mapping document, as most of my
interest is in LDAP.

Ryan

---

From: "John Strassner" <[email-masked]>
Date: Tue, 3 Aug 1999 14:25:46 -0700

See my earlier mail. The information model is indeed agnostic of any
particular storage implementation. And you're dead on w.r.t. mapping.

regards,
John Strassner
Co-Chair, Policy Framework working group

---

From: "John Strassner" <[email-masked]>
Date: Tue, 3 Aug 1999 14:08:37 -0700

Atul,

although there is an emphasis on LDAP, please note that this schema
was in fact derived from an information model that is independent of
repository platform and technology. An RDBMS schema could also have
been derived from the information model - it is simply another mapping
from data in the information model to a specific repository
implementation.

regards,
John Strassner

---

From: John Schnizlein <[email-masked]>
Date: Wed, 04 Aug 1999 12:32:07 -0400

>from data in the information model to a specific repository

The LDAP approach was in the charter for reasons now shrouded in
antiquity. Modern reconstruction of reasons for this include the
fact that there is an Internet Standard for LDAP directories, but
not for RDBMSs. It might also have been hoped that the features of
reliability and scale that these directories have through their 
replication and distribution design would be exploited by a Policy
Framework. We should find ways to exploit these advantages of 
Internet-Standard LDAP compared to RDBMSs.

Just say "no" to attempts to reflect a network's congestion state
in the policy repository. Int-serv distributes its state information
very carefully, and is working to reduce its volume; diff-serv avoids
state representation completely with per-hop behavior that responds
to local congestion in ways intended to produce predictable results
at the ends. If "policy" means anything like its ordinary usage, it 
changes slowly enough for the propagation limitations of LDAP.

>> LDAP does not have transaction support. Which makes it difficult
>>to maintain data consistency when multiple admnistrators are 
>>modifying the policies in an organization.

Is it reasonable to assume that who is authorized to modify which
parts of the policy is also a matter of policy? If this authority
were represented in the repository (LDAP has controls for this)
the problem of multiple writers for the same data element is avoided.
Could we use the access control consensus forming in the LDAP ext WG?

John
co-chair of nothing, still trying to help