Welcome to this TechNet Event

Welcome to this TechNet Event

FREE bi-weekly technical newsletter

FREE regular technical events hosted across the UK

FREE weekly UK & US led technical webcasts

FREE comprehensive technical web site

Monthly CD / DVD subscription with the latest technical tools & resources

FREE quarterly technical magazine

We would like to bring your attention to the key elements of the TechNet programme; the central information and community resource for IT professionals in the UK:

To subscribe to the newsletter or just to find out more, please visit www.microsoft.com/uk/technet or speak to a Microsoft representative during the break

http://www.microsoft.com/uk/technet

http://www.microsoft.com/uk/technet

Understanding the Active Directory Platform in the Real World

John Howard, Mark Cribben, Mike Brannigan

Microsoft UK

Today’s Sessions

Architectural Overview

Recommended design practices

In-place upgrades

Lunch: The Business case for Active Directory

Directory migration

Extending the value of the directory

Managing and Securing Active Directory

Today’s Sessions



In-place upgrades


Directory migration



Introduction to Directories

What is a directory?–At a basic level a structured way of organising useful information.

The classic example is that of a telephone directory.

What a directory is not.– It is not a database. Although they share common features the

emphasis between the two is different.

Types of directory.–NOS based directories

–Application directories

–General purpose directories

Directories vs. Databases

Common uses for directories

NOS– Core directory service for network management and administration

– Authentication of network users

– Examples such as Active Directory and eDirectory

Application– Specific applications that store configuration information without the need

for a database

– Examples include firewalls, HR applications

General purpose– Internal white pages

– A driver for provisioning

– Simple applications for which a directory is better suited than a database

Introduction to LDAP

Firstly it is a protocol defined through RFC’s

Secondly it is a set of four models–An information model to describe what you can put in the

directory

–A naming model that describes how data is arranged within the directory

–A functional model that describes what you can do with the data

–A security model that defines how the data in the directory can be protected from unauthorised access

LDAP Protocol - 1

A message oriented protocol

The LDAP protocol consists of 9 basic operations divided into 3 categories:

– Interrogation Operations:search, compare

–Update Operations:add, delete, modify, modify DN (rename)

–Authentication and control:bind, unbind, abandon

1. Open connection and bind

2. Result of bind operation

3. Search operation

4. Entries returned

5. Result of search operation

6. Unbind operation

7. Close connection

LDAP Protocol - 2

A typical LDAP exchange

LDAP compliance

Common request these days but what does it mean?

–As with all things it depends on a number of things. Principally though the question is “do you conform to the LDAP standards as defined in RFC’s”

–Open Group / DIF test certifications: LDAP Ready and LDAP Certified.

–Dependent on the standards. Compliant does not mean you implement every possible RFC for a technology. Rather that you meet the required standards.

Providers of directories

There are a number of commercial LDAP directory products available today including:

– Microsoft Active Directory and ADAM

– Computer Associates eTrust Directory 8

– IBM Tivoli Directory Server 5.x

– Nexor Directory 5.1

– Novell eDirectory 8.7.x

– Oracle Internet Directory v 10g

– Sun Microsystems Sun ONE Directory Server 5.2

Plus there are non commercial products:

– OpenLDAP

Typical Company scenario

Network

– Probably a directory of some description providing authentication services and network management for all users in the company

HR

– A significant number of companies have an HR system that is separate from the Network directory.

Firewall

– Several firewall products use authentication to determine internet access permissions. These are stored in a directory

Applications

– Commercial applications may be deployed that provide a specific function in the company and ships with its own directory.

– In house applications such as a provisioning application or a white pages or “global directory”

Without realising it most organisations are now awash with directories.

The directory challenges! (1)

Management

– How accurate is the data? Who is responsible for inputting the data? How current is the data? How available is the directory?

Information consistency

– Identities that are shared between multiple directories can become inconsistent. Representation of common data.

Interoperability

– How accessible is the data?

Synchronisation

– Do we have the right information? Where is the authoritative data stored? Synchronisation rules? Synchronisation logic?

The directory challenges! (2)

Ownership

– Who owns the data? Are they happy to share it?

Security

– How do we secure the data in the directory? Is access control important for the data stored?

Extending the directory

– How do we extend the directory? Do schema extensions clash? Are the extensions universally important?

Use

– How do we use the directory effectively? Are we doing all that we can with the directories we have?

What is Active Directory?

Microsoft’s core directory service offering

–Enterprise capable NOS Directory Service providing network authentication, authorisation, location and application services

–Available since 2000 as part of Windows 2000 Server

–Supports LDAP v2 and v3 industry standards

–Ships free as part of the Windows Server Operating System

AD concepts – 1(Logical)

Boundaries– Security

– Administrative

Forest– A forest is the security boundary for a single Active Directory deployment.

– Shared schema and configuration

– A single, logical entity

– Comprised of one or more domain trees

Domain– A Domain is an administrative boundary within an AD forest.

– Boundary for password / security policy

– Partition / control replication of AD data

Ad.microsoft.com

Eu.ad.microsoft.com Na.ad.microsoft.com

AD concepts – 2 (Logical)

Tree

–AD domains a logically organised in trees

A contiguous DNS based name space eg. Ad.microsoft.com is the forest root domain. It has two child domains that form a single domain tree within the forest: eu.ad.microsoft.com and na.ad.microsoft.com


Organisational Units (OU’s)

–A way of further partitioning data within a domain for the purposes of delegating administration or applying Group Policy

–Hierarchical within the domain

–Can be easily moved or renamed


Schema

–The definition of the objects that can be created within a forest. Eg. Users, computers, printers.

–The boundaries of the individual attributes.

–Default permissions on attributes

–Unique OID’s essential.

–Once defined cannot be removed from AD

–Objects and attributes can be deactivated in Windows Server 2003


Trusts. Defines the relationship between different logical components of an AD installation.

–Within a forest all domains are trusted.

–External trusts

–Forest trusts

–Kerberos trusts

AD concepts – 6 (Physical)

Sites– A logical representation of the physical nature of your underlying network

infrastructure.

– Used for controlling authentication process, replication and accessing “local” resources.

– Requires defining IP subnets.

Domain Controllers (DC’s)– Servers that physically host the Directory.

– Replicate directory information

– Authoritative for their domain NC

– Writable (operations such as creating new objects or updating existing objects)

Global Catalog (GC)– A DC that holds read only copies of other domain NC’s within the forest as well as

the writable copy of the domain NC for which it is authoritative.

– Easy and known way to search the forest for information

AD and DNS

DNS is a name resolution service and is separate from AD.

–Used to provide the name space rules for AD

–Used to locate AD and AD resources

DNS information can be stored in AD

–Can improve the security of DNS information

– Improves replication / transfer of zone data

How AD distributes data

Domain Controllers

–DC’s are distributed around the organisation to facilitate local operations

Replication

–The mechanism for ensuring all DC’s contain up to date information

–Multimaster loose consistency with convergence

– Intra site replication for DC’s in the same site

– Inter site replication between sites

Roles for AD

NOS

– Primary role for managing the network, users and machines

Authentication

– Provides the authentication service for the network.

– Default in Active Directory is Kerberos

– Can also be utilised as an authentication service for other applications

Application

– AD can be extended to support applications

– A number of MS applications utilise AD (Exchange, SMS, ISA to name a few)

Scalability

AD as a NOS Directory has the capacity to handle any organisation

– Tested with millions of objects

– Technically could support 1 billion objects!

– Currently supporting many of the largest companies in the world

There are some technical limitations for some objects

– Number of DC’s in a domain

– Number of DNS Name Servers

– Number of Groups a user can belong to

– Number of users in a group*

The Microsoft directory strategyD

irec

tory

Arc

hit

ectu

reD

irec

tory

Arc

hit

ectu

re

Dir

ecto

ry T

ech

no

log

ies

Dir

ecto

ry T

ech

no

log

ies

Active DirectoryActive Directory

ADAMADAM

MIISMIIS

IIFPIIFP

ADFSADFS

GPMCGPMC

FederationFederation

SynchronisationSynchronisation

AuthorisationAuthorisation

ProvisioningProvisioning

SecuritySecurity

ManagementManagement

AuthenticationAuthentication

Getting to a Single Directory

Very difficult in the enterprise

–Existing application requirements

–Scope of application (local vs. global)

–Schema requirements

–Control of application/identity information

How to deal with multiple account stores

– Infrastructure Directory – Global

–Application Directories – Local to Application

–Meta-Directory – Integration/Business Process

Where We Are Today

Directories deployed per-app; little re-use

Provisioning, sync are ad-hoc

Active Directory

Portal Portal applicationapplication

WhitepagesWhitepages

GenericGenericLDAP-basedLDAP-based

appappHR/ERP HR/ERP

appappLDAPLDAP

Centralized Centralized managementmanagement

Policy & SSOPolicy & SSOfor Windowsfor Windows

DatabaseDatabase

LDAPLDAP

Generic Generic dumpdump

(Non-existent)(Non-existent)

Ad-hoc Ad-hoc syncsync

iPlanetiPlanet

eDirectoryeDirectory

Outlook/Outlook/ExchangeExchange

LDAPLDAP

iPlanetiPlanetMAPIMAPI

The Solution

DS-enabledDS-enabledappapp

HR/ERP HR/ERP appapp

CentralizedCentralizedidentity identity

managementmanagement

DatabaseDatabase

MIIS 2003MIIS 2003

IntegrationIntegrationServicesServices

App DSApp DS

App DSApp DSADAMADAM

Infrastructure Directory

ActiveActiveDirectoryDirectory

DS-enabledDS-enabledappapp

App DSApp DSADAMADAM

DS-enabledDS-enabledappapp33rdrd-party DS-party DS

accessaccess

syncsync

Today’s Sessions



In-place upgrades


Directory migration



Documents

Welcome to this TechNet Event