Front cover - IBM Redbooks

340 Lotus Security Handbook
Identify authoritative sources
The information stored in a user's directory record is organized by discrete
attributes or fields. The scope of information stored in a directory is often set by
the requirements of an application or a set of applications. An authoritative
source is defined as the highest organizational authority that creates, generates,
or validates the data attribute values. Data validation may occur at initial data
entry, or any time the data is updated or maintained. Each attribute may have
been validated or generated by a different part of the organization.
An example of an authoritative source would be an HR employee directory where
the unique employee ID number gets generated.
Identify unique keys
Unique keys are the unique identifying attributes for each person, computer, or
other resource. An attribute must be globally used and globally unique in order to
be a key. If a single unique key is not used, a combination of attributes can be
used to form a unique key. Note that what appears to be an ideal unique key may
in fact have limitations. For example, an SMTP e-mail address is generally
unique for each employee; however, not all employees might have e-mail.
A second aspect of identifying the unique keys is to define the bounds of the data
the key may be applied to. While an organizational employee ID number might
be unique within the U.S., it may not be present or available in other countries.
When multiple keys are available in a given repository, they should be classified
into primary keys and secondary keys, based on their reliability. For example, a
primary key might be Employee ID, a secondary key the corporate SMTP e-mail
address, and a third key the fullname combined with the telephone number and
work location.
Determine the integration strategy
Once the existing data sources and correlation keys have been identified and
inventoried, the next step is to select a strategy for merging (or integrating) the
data. As we previously mentioned, there are basically two types of directory
integration strategies:
► Metadirectory
► Central master directory
For most organizations, a metadirectory is quicker and easier to implement than
a new central, multipurpose master directory. It is important to understand the
distinction between a metadirectory and a central master directory.
A metadirectory defines the relationships and data flows between the different
existing directories. They typically have connectors that are specifically designed
for particular directories, such as Domino, Active Directory, PeopleSoft HRMS,