Given by Roman Markowski at CPS714 Computational Science Information Track on June 7 99. Foils prepared July 6 99
Outside Index
Summary of Material
This covers Distributed Object Directory Services
|
Outside Index Summary of Material
Roman Markowski |
IS Manager |
Northeast Parallel Architectures center |
CPS 714 June 1999 |
Directory Services play a vital role in Internet and Intranets by providing access to a variety of information about:
|
Example of Directory Services
|
Directory Service is a collection of software that is used to store information about an enterprise. It generally consists of at least one directory server and one or more directory clients |
DNS is an example of of a well-known client-server directory. Service (information limited to IP addresses and names) |
A true directory service is used to store virtually unlimited types of information |
Each e-mail system has its own directory system which maps user's name to an e-mail address. These directories cannot exchange information |
Problem: every enterprise is using too many directory services which do not share data between themselves (it is known as N+1 problem) |
The concept of a global directory service was invented to provide a single, centralized repository of directory information that any application can access
|
A directory service IS NOT
|
A directory service is tuned for read operations (to maximize overall search performance) |
Internet and TCP/IP service that maps network addresses , for example, 128.230.117.25, to an easy to remember names, such as merkury.npac.syr.edu |
TCP/IP tools (like telnet, ftp, smtp) access DNS to locate names and resolve them into IP addresses |
Names and numeric addresses are stored in many locations in a hierarchical structure. Each site has a domain name server that maintains information about the local hosts |
Unix: /etc/hosts |
Windows NT: \WinNT\system32\drivers\etc\hosts |
127.0.0.1 localhost |
128.230.117.25 merkury.npac.syr.edu merkury |
ROOT |
GOV |
ORG |
US |
COM |
NET |
MIL |
EDU |
SYR |
NPAC |
NASA |
FDA |
NSF |
MIT |
SGI |
SUN |
IBM |
Critical component of the Internet; maps names to IP addresses; mail exchanger; global directory service |
Unix clients use resolver to access DNS servers |
DNS servers query each other to resolve names |
Client |
Local |
DNS |
Company |
DNS |
COM |
DNS |
Root |
DNS |
www.company.com |
SGI Irix: /etc/resolv.conf |
SUN Solaris: /etc/resolv.conf, nsswitch.conf
|
hostresorder local dns nis |
search npac.syr.edu |
nameserver 128.230.7.250 |
nameserver 128.230.164.130 |
nameserver 128.230.12 |
nameserver 128.230.7.250 |
nameserver 128.230.164.130 |
nameserver 128.230.12 |
search npac.syr.edu |
hosts: files nis dns |
BIND - Berkeley Internet Name Domain - most common DNS |
DNS is a distributed database that resides on different domain servers. There are primary, secondary, and cash-only servers
|
DNS server can provide lots of information about a network (nodes, operating system, people responsible, mail servers) |
DNS can provide "unwanted " information for
|
nslookup (exists for Unix and WinNT) |
> help |
> set querytype=MX list mail servers and name servers |
>npac.syr.edu |
> set querytupe=NS list name servers |
>npac.syr.edu |
> set quarytype=A list IP addresses |
>merkury.npac.syr.edu |
> ls -d npac.syr.edu list all computers in the domain |
> ls -a npac.syr.edu list all canonical names and aliases |
> ls -t mx npac.syr.edu list all mx records |
> set type=mx |
> netscape.com all mail servers in the domanin |
> set type=PTR |
> 25.117.230.128.in-addr.arpa |
Standard resource records
|
Dual- server DNS service allows to separate
|
External DNS
|
Local |
Client |
Local |
DNS |
Query |
Response |
External |
Client |
External |
DNS |
A firewall prevents external clients from accessing the internal name server |
This configuration offers 2 distinct views of the network |
Lightweight Directory Access Protocol
|
LDAP - IEFT standard based on OSI X.500 protocol for directory and resources management. LDAP allows users to create, delete, modify and query network directories form Web browsers. |
X.500 Directory Service editions: 1988, 1993, 1997 |
LDAP v 2 is based on X.500 edition 1988 |
LDAP v 3 is based on X.500 edition 1993 |
LDAP is using TCP instead of OSI components as its transport protocol |
LDAP = X.500 Lite (TCP used for transport) |
In 1988 OSI defined a powerful X.500 global directory service OSI based; OSI is abandoned now
|
LDAP was developed to provide clients with a lightweight method of accessing X.500 databases eliminating DAP (OSI Directory Access Protocol). DAP creates so much overhead that is not practical. |
LDAP will help navigate but will not replace X.500 |
LDAP can be used to communicate with any attribute based directory, including X.500 |
It evolved as a standalone protocol: LDAP is a client-server product
|
LDAP v1 1993 (implemented in the University on Michigan) |
LDAP v2 1995 RFC 1777,1823,1959 (also implemented in the University of Michigan)
|
LDAP v3 December 1997 RFC 2222, 2251-2256
|
Directory Tree Overview |
o=npac.syr.edu |
ou=people |
ou=groups |
ou=servers |
uid=roman |
cn=systems |
cn=admin |
The entry in an LDAP directory service are often visualized as |
a tree-like structure. The design of the Tree structure is very |
important (root, branches, etc) |
DSE |
o=ist.syr.edu |
referral |
Syntax for making LDAP queries from a Web browser
|
Problem: the same query executed on different LDAP servers containing similar information can return very different results |
Directory Tree - visualized as tree-like structure
|
Distinguished Name - uniquely identifies a directory entry:
|
Relative Distinguished Name - the left-most value
|
Suffix - identifies directory-tree's root entry
|
Root Distinguished Name (treated as directory super-user)
|
Root Entry - first entry in the directory tree
|
Base DN - search point, entry from which search will occur |
LDAP is an Internet standard protocol for accessing and updating online directory information. Includes:
|
LDAP provides:
|
Schema: total set of "objectClasses" and "attributes". It is a framework for naming rules, structure rules, content rules, entry definitions |
LDAP server comes with a standard schema of hundreds of object classes and attributes. Standard schema can be extended but not deleted. Object classes can use "inheritance" to define total list of attributes. Some attributes are required, other are optional |
Security Policy
|
LDAP v2 security using Kerberos version 4 |
LDAP v3 uses Simple Authentication and Security Layer (for Authentication, Integrity, Confidentiality) |
Replication (for fault tolerance, load balancing)
|
How to create contents:
|
LDAP client
|
LDAP can be bound to several languages (Java, JavaScript, ODBC, VBasic) |
Well-known open source projects (Apache, FreeBSD, Linux, Perl, Sendmail, TCL, Python) all work on LDAP interfaces |
Netscape provides Software Developer Kits (SDKs) to help write clients and tools (Java, C) |
Open LDAP project: fully featured, open source LDAP suite of application and development tools |
Schema standardization is progressing |
The standard (IETF LDAP) won't be stable until sometime in 2000 |
http://www.umich.edu/~dirsvcs/ldap/doc/guides/slapd/index.html |
LDAP servers available from
|
Communicator 4.x can make LDAP client queries |
Some public LDAP Internet services
|
Simple, Object-oriented, Java-based, Network-centric service architecture |
Pronounced "Gee-nee": set of services and protocols |
Java's "write once, run everywhere" philosophy can be the way to simplify network design |
A Jini-compliant device (disk tower) connects directly to an IP-based network
|
Java language is assumed to be everywhere |
Today we have attach disks to a file server. We need "drivers" for all devices and all flavors of operating systems. Tomorrow (with Jini) we will plug the disks directly to the network |
This will work with
|
Both hardware and software are services
|
Very general picture: in future digital TV, phone, computer, DVD player can (will) communicate via Jini |
Today's networks are too complex |
Jini enables spontaneous networking
|
Provide reliable networks
|
Designed for the network
|
Above all, simplicity: use the network as easy as using a phone |
Defines object interactions, not implementations |
Helps in developing reliable, distributed applications |
Service is defined by one or more Interfaces
|
Set of services includes: devices, software services, business objects, etc |
Jini requires Java at the network (services identified by Java type; proxies may need code downloaded) |
Jini network is built on top of Java software infrastructure; It enables all types of devices to work together without extensive planning or human intervention |
Jini eliminates the need for configuring devices or installing drivers; Jini allows devices to dynamically establish communication across a network. |
Everything from digital cameras, cellular phones PVs, VCRs, CD players to home appliances is capable of certain level of network intelligence |
Jini is a collection of services (hardware, software, or both) |
When "a Service" connects to the network, it sends a small "hello" packets (512 bytes) to announce its existence |
Jini "Lookup Service" notices this packet and query the service to discover it capabilities, and makes this info available for other devices on the network |
Then the Service registers with the Lookup Service, it provides a proxy object |
When a client wants to use a service (for example scanner) it asks the Lookup Service to provide info about available services (the Lookup service provides a copy of the proxy object. The client makes calls to the proxy object that arranges to do the work) |
When the Lookup Service does not exist, the client broadcasts a request for services to register with it (the client can act like its own lookup service) |
The "Lookup Service" is just another Jini service |
Java's Remote Method Invocation is the heart of Jini. RMI provides communication and security for Jini clients and servers. |
RMI extends objects to the network |
The entire Jini core code is 48 KB. The Java Archive (JAR) with the whole version of Jini is under 70 KB |
3 layer Jini architecture: simplicity of object-oriented design |
Java Spaces |
Other |
Transaction |
Manager |
Lookup |
Discovery |
Join |
JVM ( RMI Included) |
Jini |
Infrastructure |
Java - allows |
to share the core |
Services |
Lookup Service |
Discovery Request |
Discovery Response |
Service |
Proxy |
Object |
Service registration |
Jini Service |
(scanner) |
Service Registration |
Jini |
Client |
Lookup Service |
Discovery Request |
Discovery Response |
Lookup Request |
Service |
Proxy |
Object |
Lookup Response |
Service Lookup |
Jini Client |
Jini Service |
(scanner) |
Service |
Proxy |
Object |
Client / Service Interaction |
Federation: Jini network, a group of cooperation objects |
RMI extends objects to the platform
|
Federation through Discovery, Join, and Lookup
|
Leaving the Jini Federation
|
Discovery and Lookup is the key component of the Jini infrastructure |
Network service
|
not a naming or directory service
|
Focus is on types, not names
|
The new service connected to the network announces its presence by broadcasting 512-byte packet |
The Lookup service answers by requesting more information (a proxy object) describing the service, and interface that clients will use to communicate with the service |
The proxy object is valid for specified interval. When expires, it must be renewed or removed (this solves the problem of vanishing services) |
Finding other network services (by service type or attributes)
|
Incremental browsing: by service type, by attribute set class, by attribute value |
A client requests access to the service for a certain duration |
Introduces time to resource allocation
|
Leases can be
|
Leases can expire - this solves the problem of sevrices become unavailable |
Net.jini.admin administration services |
net.jini.discovery handles discovery process |
net.jini.entry common code for entries that Jini stores |
net.jini.event handles remote events; event delivery over net |
net.jini.lease manages leases |
net.jini.lookup objects related to the lookup service |
net.jini.lookup.entry objects and beans that represent service information |
net.jini.transaction transaction support |
net.jini.transaction.server managing transactions |
RMI: core of Jini communication; object oriented RPC system; allows make Java objects available across a network |
Discovery: the process a service uses to notify the Jini federation that it is available (followed by Join process) |
Join: the process a service uses to inform Federation about itself |
Federation: Jini network, a group of cooperation objects |
Java Spaces: a standard service that provides one way to store objects; a network objects repository |
Proxy Object: a remote Jini object. The Lookup service holds the local proxy object and provides it to clients |
Transaction: a client attempt an operation on multiple objects (allows multi-object coordination) |
Jini software is an infrastructure that runs on top of a Java platform to create a federation of virtual machines |
The lookup service in Jini is very powerful: it uses the Java platform type system as the namespace. This means that is stores not fixed name-value pairs, but objects and objects graphs (the actual behavior of an object) |
You can search for an object or service based on a desired behavior, not just on its name; after finding it you immediately know how to use it |
SLP - Service Location Protocol, mechanism for dynamically finding services on the network (lack of code mobility as in Jini) |
IMS - Information Management Service, similar to Jini but limited to searching by name-value pairs only |
Jini requires JDK 1.2, known as Java 2 |
Jini software is just Java software code |
Jini competitors: Microsoft Transaction Server |
http://java.sun.com/products/jini/
|
http://www.sun.com/jini/ |
http://java.sun.com/products/jini/specs/index.html
|
http://java.sun.com/products/jdk/rmi/index.html
|
JNDI stands for Java Naming and Directory Interface |
Developed by JavaSoft, with SunSoft, IBM, HP, Netscape, Novell |
JNDI is a generic directory API specified in the Java that provides directory and naming functionality to Java applications
|
From a user's perspective, there is one namespace consisting of composite names. The organization can use LDAP, NDS, NIS, etc |
Any Java application that needs to access information about users, machines, networks and services should use JNDI |
Different directories have different ways of dealing with security. JNDI allows for applications to work with directory specific security systems |
JNDI provides an excellent object-oriented abstraction of directory and naming. Developers using JNDI can produce queries that use LDAP or other access protocols to retrieve results (JNDI SPI - Service Provider Interface) |
Java Application |
JNDI Implementation manager |
LDAP |
NDS |
JNDI-RMI |
LDAP |
JNDI API |
JNDI SPI |