Java™ Application Development on Linux - Dator

486Chapter 21Introduction to Enterprise JavaBeansAt each node there is a type (c, cn, url, and so on) and a name (or value)for that type. The definitions of these types and the lists of types permitted ata particular level depend on a schema which is controlled by whoever controlsthe server that serves the given level of the hierarchy. In other words, as withDNS, if you want to be part of the public, global namespace, you have to playby the rules of the ancestor nodes. You can do what you want with your pointof control and below, but you must obey the naming schema of all of yourancestors. 5This explains why so few organizations actually use LDAP globally(i.e., integrating directly with all other public LDAP servers in the world). Instead,they tend to use LDAP by setting up schema and servers that are completelyinternal and private so that they do not have to use the many requiredparent nodes it would take to hook up to the global LDAP namespace. 6LDAP can (and does) fill books of its own. The type/name pairs are bulkyto type and hard to remember, but they allow you to easily map in entire othernaming systems, by simply assigning a type to a naming system and allowingthat system’s names to be values at that level. Remember that these names arehierarchical, so everything under cn (normally used for “common name”) appliesto (in this case) Michael Schwarz. If I defined the schema for my space,I could put anything I wanted under that name.A common use of LDAP is for centralizing authentication and authorizationdata for users. Users authenticate to LDAP and all systems in an organizationcan validate a single credential to authenticate the user—the holy grail ofsingle sign-in. Alas, doing this right is nontrivial because LDAP doesn’t specifyany mandatory authentication and encryption scheme. (Thus it is often thehacker’s holy grail of single sniff-in and 0wn3d systems.)5. We want to be clear: You only have to do this if you wish to give those ancestors and outsideusers access to your directories. You are free to create entirely private directory structures thatneed not conform to anyone else’s schema. It all depends on the purpose and audience of yourdirectory.6. Another reason is that LDAP itself has no cryptographically secure authentication or transportmechanisms. That means that hooking up all your directory data to the global Internetgives hackers a one-stop opportunity to steal your data. Not good. Of course, as with otherprotocols, there are several add-on security mechanisms for LDAP.