Front cover - IBM Redbooks

8.1 Directory fundamentals
310 Lotus Security Handbook
A very broad definition of a directory is a repository used to hold any kind of
information that may be used for different purposes by different clients. The
repository is a collection of information about objects arranged in a hierarchical
structure. It is a specialized database that enables users or applications to find
resources that have the characteristics needed for a particular task.
If the name of an object is known, its characteristics can be retrieved. If the name
of a particular individual object is not known, the directory can be searched for a
list of objects that meet a certain requirement. Directories can usually be
searched by specific criteria, not just by a predefined set of categories.
A directory is a specialized database that has characteristics that set it apart from
general purpose relational databases. One characteristic of a directory is that it is
accessed (read or searched) much more often than it is updated (written).
Because directories must be able to support high volumes of read requests, they
are typically optimized for read access. Because directories are not intended to
provide as many functions as general-purpose databases, they can be optimized
to economically provide more applications with rapid access to directory data in
large distributed environments. Note that the logical object structure is
hierarchical, although the physical data object storage might reside in relational
database tables. This is the case with IBM Directory Server, which uses DB2
tables to store the directory data.
A directory can be centralized or distributed. If a directory is centralized, there is
one directory server (or a server cluster) at one location that provides access to
the directory. If the directory is distributed, there are more than one servers,
usually geographically dispersed, that provide access to the directory.
8.1.1 LDAP directories
LDAP defines a standard method of accessing a directory service. The LDAP
standard is designed to provide access to directories supporting X.500
hierarchical models without the intense resource requirements of the full X.500
Directory Access Protocol (DAP), hence the term “Lightweight DAP” or LDAP. It
is a client-server model of communication where the LDAP directory server is
capable of serving many simultaneous client requests on the standard TCPIP
port 389 or port 636 if the server supports SSL.
The “LDAP standard” consists of a collection of related IETF standards,
including:
– RFC-1777 LDAPv2 standard
– RFC-2251 LDAPv3: the base LDAP version 3 standard