Front cover - IBM Redbooks

8.3.5 Data flows
requires more than one search and retrieval to map the token (cookie) name or
identifier to the DN to be used for access purposes. If we use the same records
shown in Example 8-2 on page 323, but we do not have the “notesname”
attribute in the LDAP record, notice that we have an “empid” attribute that
correlates to part of the “employeeid” in the Domino Directory. For this case, we
will assume that a custom DSAPI filter is being used to perform the name
mapping in Domino. So if our custom session cookie architecture provides us
with the LDAP “empid=10543,” Domino would first need to retrieve the DN for the
user, so it searches the LDAP directory for “empid=10543” and finds
“cn=Brendan C Hinkle, ou=West, o=Acme, dc=acme, dc=com.”
It needs to retrieve the DN because Domino needs to verify that the DN of the
pre-authenticated user matches the naming context rule defined in DA for the
LDAP directory. So now our DSAPI filter knows the user credentials are valid, but
it still needs to map the cookie identifier, the “empid,” to a Notes hierarchical
name. So next our DSAPI filter would need to find a Domino directory entry for
empid=10543. Since the format of the “employeeid” attribute in Domino is the
employee ID number that has been prefixed with the user’s initials, our search in
the Domino directory needs to be transformed to the “new” format, searched for,
then once found, we could pass the user’s name in the form of “CN=Brendan
Hinkle/OU=Finance/O=Acme.” So we needed two directory lookups to determine
the mapped name to use for access control purposes.
If this example was hard to follow, you now know why we recommend against
any session cookie scheme that involves indirect name mapping!
Data flows are the threads of the communications between directories and their
content. Data flows are usually drawn as arrows which point in the direction of
data movement, from source directory to target directory.
Each data flow represents a unique message being passed from one set of data
sources to another. This ties back to the earlier concept of authoritative sources
being defined in terms of attributes. So rather than assume all the attributes of
one directory are fed into another directory, only the authoritative attributes are
taken from the source, and the same source data may be applied to multiple
target directories.
One exception to assignment of a data flow is user passwords. We discussed the
security concerns and issues with being able to extract user passwords and write
them to other target directories in “Password synchronization” on page 284.
Chapter 8. Directory strategies 325