Front cover - IBM Redbooks

8.3.1 Data sources
8.3.2 Object classes
316 Lotus Security Handbook
We already discussed the concept of authoritative sources earlier in this chapter.
In the context of directory synchronization, the data sources are the directories or
repositories that we need to exchange data between.
Before you can identify the tools or methods you can use to exchange data, you
must first identify the directories and the interfaces supported by each.
Directories generally support some form of application programming interface
(API), they might also support LDAP reads and updates, and they might support
a bulk file import or export. We discuss tools for directory synchronization later in
this chapter. For all practical purposes, we can use the terms “data source” and
“directory” interchangeably. However, note that we must make the distinction
between a source versus a target. Note that the same data can have multiple
target directories, but will have only one source directory.
The use of standard object classes and attributes facilitates a “universal”
language for the mapping of data between one directory and another. Even if
your directory synchronization doesn’t require an intermediary LDAP directory,
mapping your current data types and attributes to LDAP standard object classes
and attributes provides a common data definition that can be used to match up
attributes between any two directories.
An object class is an LDAP term that denotes the type of object being
represented by a directory entry or record. Some typical object types are
“person”, “organization”, “organizational unit”, “domain component”, and
“groupOfNames”. There are also object classes that define an object’s
relationship to other objects, such as object class “top” that denotes the object
may have subordinate objects under it in a hierarchical tree structure. Note that
some LDAP object classes may be combined. For example, an object class of
“organizational unit” will most often also be simultaneously defined as a “top”
object class because it will have entries beneath it.
LDAP object classes define sets of standard attributes that are listed as “MUST”
contain (mandatory attributes) and “MAY” contain (optional attributes). Different
object classes may prescribe some attributes that overlap, or are redundant with
other object classes. And it is common practice in LDAP directories to use
multiple object classes to define a single directory entry. Most object classes are
defined in a hierarchical order, where one object class is said to “inherit” from
another superior object class.