WebSphere Application Server V7.0: Concepts ... - IBM Redbooks

LDAP is a fast and simple way of looking up user entities in a hierarchical data
structure. It has advantages over using databases as a user repository in terms
of speed, simplicity, and standardized models or schemas for defining data.
Standard schemas have standard hierarchies of objects, such as objects that
represent a person in an organization. These objects, in turn, have attributes
such as a user ID, common name, and so forth. The schema can have custom
objects added to it, meaning that your directory is extensible and customizable.
Generally, LDAP is chosen over a custom database repository of users for these
reasons. LDAP implementations (such as IBM Tivoli Directory Server) use
database engines under the covers, but these engines are optimized for passive
lookup performance (through indexing techniques). This is possible because
LDAP implementations are based on the assumption that the data changes
relatively infrequently and that the directory is primarily for looking up data rather
than updating data. For more information about IBM Tivoli Directory Server, see
the following Web page:
http://www.ibm.com/software/tivoli/products/directory-server/
2.2.2 Integration with WebSphere Application Server
You can enable security in WebSphere Application Server to manage users, and
assign specific roles to them. To have a user account repository you must select
the type of user registry to be used (in this case, an LDAP registry). Tivoli
Directory Server can be used as a standalone LDAP registry for user account
repository of WebSphere Application Server. You can configure your user
account repository through the Integrated Solutions Console or through the
wsadmin command line tool.
Security, networking, and topology considerations
Because the LDAP server contains sensitive data in terms of authentication,
authorization, and privacy, the LDAP server belongs to the data layer of the
network. It is suggested to enable SSL options in the WebSphere Application
Server security configuration so that the data is encrypted between the
application server layer and the data layer.
Legal considerations (privacy and data protection): There might be some
legal or regulatory issues that surround storing of certain data types, such as
personally identifiable data in the European Union, on IT systems. Ensure that
you have consulted your legal department before deploying such information
on your systems. These considerations vary by geography and industry.
For a list of supported directory servers for WebSphere Application Server, see
1.4.5, “Directory servers” on page 22.
34 WebSphere Application Server V7.0: Concepts, Planning, and Design