Chapter 23. Directory Coexistence

• Why Is Coexistence Important?

• Coexistence Techniques

• Privacy and Security Considerations

• Determining Your Coexistence Requirements

• Directory Coexistence Implementation Considerations

• Example: The ldapsync Tool: One-Way Synchronization with Join

• Directory Coexistence Checklist

• Further Reading

• Looking Ahead

The previous two chapters talked about how existing and new applications can use your directory. The focus of this chapter is directory coexistence , the task of integrating other data sources with your directory.

Integrating other data sources requires that you understand the desired relationships between the data in your directory and data maintained elsewhere, and that you create procedures and policies to correctly maintain these relationships. Directory coexistence also allows your directory to complement existing business processes within your organization. Your directory coexistence strategy determines whether your directory is an island ”isolated from the rest of your enterprise ”or is integrated and coexists peacefully with your existing infrastructure and business processes.

Directory coexistence is often the biggest problem that directory administrators face. Not addressing this problem can lead to user complaints, spiraling data management costs, and an ineffective and unpopular directory service. Therefore, it is important to address this issue in your directory deployment (or else at least to convince yourself that you don't need to).

There are many reasons to integrate or link data in your directory with data held in other data sources. Here are some examples:

• You have existing data in another database that you want to make available to directory applications.

• You want to aggregate widely used information in a logically centralized directory service (or in another database that is widely used) so that people can access it in one place.

• You want to provide a central management point for data, reducing the cost of maintaining it.

• You want to use the directory as the authoritative source for new data elements that are used to populate other databases.

• You want to use the directory as a conduit to send data between other systems that otherwise could not share any data.

As these examples suggest, it is rare to find a directory service that does not need to integrate with any other data sources.

The correct approach for achieving directory coexistence depends on your requirements, the capabilities of your directory, and the capabilities and business processes associated with the other data sources you need to integrate. In some situations, a simple one-time population of the directory from another source (or vice versa) may be all that is needed. In other cases you may need to set up an ongoing two-way relationship between your directory and a data source, in which data may be updated by either one. These two examples are extremes; your actual requirements will probably lie somewhere in between.

Whatever your needs, there are a variety of techniques for accomplishing integration and coexistence, ranging from homegrown scripts and programs to off-the-shelf software. After you determine your needs, you'll need to figure out whether any off-the-shelf software fits the bill. Chances are that even if you do find suitable software, you will still need to develop some custom tools and scripts. Directories, databases, and the environments in which they run are so variable that it is unlikely that an off-the-shelf software package will meet all of your needs.

This chapter takes you through the process of determining your directory coexistence needs and how to meet them. You will learn about the available techniques for establishing coexistence, the data sources with which your directory needs to coexist, the kind of integration you need, and how to accomplish it. You will learn to distinguish among directory migration, directory synchronization, metadirectories , and virtual directories ”all of which are tools that help accomplish directory coexistence. The chapter ends with an example of a homegrown directory coexistence tool written in Perl.

Often it is difficult and time-consuming to achieve coexistence, and many organizations underestimate the amount of work involved. This area is both technically and politically challenging (see Chapter 6, Defining Your Directory Needs, for a discussion of political considerations). But coexistence with other data sources makes a directory service more valuable .