Understanding and Deploying LDAP Directory Services > 1. Directory Services Overview > What Is a Directory? |
What Is a Directory?Most people are familiar with various kinds of directories, whether they realize it or not. Directories are part of our everyday lives. Everyday examples of directories we encounter include the phone book and yellow pages, TV Guide , shopping catalogs, the library card catalog, and others. We refer to these directories as everyday directories , or sometimes offline directories . Using these examples as a guide, it's clear that directories help people find things by describing and organizing the items to be found. Information in such directories ranges from phone numbers to television shows, from consumer goods to reference material, and more. Directories in the computer and networking world are similar in many ways, but with some important differences. We call these directories online directories . Online directories differ from offline directories in the following ways:
These differences are explored in the sections that follow. It's also important to understand that there are different kinds of directories. We expand on this notion more in Chapter 2, "A Brief History of Directories." We'll give a brief categorization here in order to frame the rest of our discussion. We divide directories into the following categories:
In this chapter we will make reference to all four types of directories. Our focus is squarely on the general-purpose type of directory, however. Directories Are DynamicThe everyday directories you are familiar with are relatively static; that is, they do not change very often. For example, the phone book comes once a year; you have to call information to get more up-to-date information. A new TV Guide is produced every week, but still your favorite show is pre-empted without notice more often than you'd like. The shopping catalogs you receive in the mail are updated only several times a year, at most; also, they do not contain such useful information as which items are in stock in which colors and sizes. Why? Because that information changes so often that by the time the catalog got to you, it would be out-of-date. By contrast, online directories have the capacity to be kept much more up-to-date. This feature is not always used, of course. Directories are usually only as up-to-date as their administrators choose to keep them. Sometimes administrative procedures are put in place to update the directory automatically. Often, online directories are much better if they are their own ultimate authority for the information they hold. As soon as information changes, it can be updated in the directory and made available to users. It's easy to see how this online update capability can be used to make directories more accurate, resulting in a more useful directory. This kind of improvement is incremental. But online updates have the potential to produce more revolutionary improvements, too. These improvements open the door to brand new directory applications that have no offline analogy. For example, consider a directory that contains up-to-date information on who's employed at your organization. Such a directory could be consulted by an automated card reader to authorize access to buildings and rooms at your company. In this case, access could be revoked easily and instantly, simply by making a change to the directory. As another example, consider a directory containing location information that is updated as you move from office to office, from hotel room to hotel room, and to other locations. This directory could be consulted to route your phone calls, faxes, and messages to you wherever you are. Traditional paper directories could never be used for such a purpose. However, the very nature of this application requires very frequent updates of the information. This superior update capacity of online directories not only tends to keep information more up-to-date, it also can be used to distribute the update responsibility. The closer information is to its source, the more accurate and timely the information is likely to be. There are at least three reasons for this:
To illustrate , consider the location directory example described previously. The source is the user (you) and the information is your current location. Who knows better than you where you are? (One would hope you know that best!) Which is the more accurate path for an update to be received on: directly from you or from your administrative assistant (your typing skills not with- standing)? Suppose the update came from a directory administrator typing in information reported by your assistant relayed from you? At each step, opportunity for error is introduced, and the accuracy is further decreased. Finally, who is most motivated to have accurate information about you in the directory? Again, it is likely to be you, the source, because you do not get your phone calls, faxes, and mail unless the information is accurate. Of course, this example assumes that you are responsible enough to want the information to be accurate and that you have the tools and expertise to make it happen. Directories Are FlexibleAnother important difference between static, everyday directories and online directories is that online directories offer far greater flexibility. This flexibility has two aspects:
Flexible ContentOffline directories are static in terms of their content. By that we mean that offline directories contain a very restricted and seldom extended set of information. For example, if you wanted to know something beyond the phone number, address, and name information provided by your phone book, you are probably out of luck. But there is a whole host of other useful information you might like to have. Fax number, mobile phone number, pager number, email address, even a picture or short biographical sketch, to name a few, are all items in the same category as the traditional phone information. But these items are seldom, if ever, included. By contrast, online directories can easily be extended with new types of information. The cost of additions like these are huge with printed directories but relatively small with online directories. A printed directory would need to be redesigned, reprinted, and redistributed. The cost of this is enormous . The cost of printing the previous directory cannot be leveraged much at all. Online directories, however, are typically designed to be extended without a redesign. There is no need for reprinting because changes are reflected automatically and immediately. Nor is there a need to redistribute the directory because clients access the directory online and do not keep their own copy. Some clients may cache or replicate portions of the data, but these copies can be updated automatically. Extending a printed directory in this way is usually done only if a large majority of the users of the directory is clamoring for the information. This is the case because of simple economic and practical reasons. First, as a producer of a printed directory, you could not afford to double or triple the size of your directory to include more information without a compelling reason; doing so would double or triple your cost in producing the directory. Also, from a practical standpoint, the directory itself could become unwieldy and inconvenient for the very customers you are trying to serve. An online directory, on the other hand, can be extended without incurring such costs. Adding a new data item used by only a small proportion of your users suddenly becomes cost-effective . The cost is incremental to the cost of providing the basic service. It may only involve adding some more disk space to your system and marginally increasing backup time, management, and support costs. No inconvenience is experienced by users of your service, however, because they need not even see the additional information. Those customers who want the new information can easily get it. An economic incentive exists as well: You could charge extra for these premium directory services. Flexible OrganizationThe second way online directories provide more flexibility is in how they let you organize your data. Let's continue with our phone book example. The phone book contains name, phone number, and address information, organized to facilitate searching by name. If you wanted to search by phone number or by address, you would find it difficult, to say the least. Other specialized directories that are organized to facilitate these kinds of searches may exist, but there is no guarantee of consistency with differently organized directories. Your phone book organized by name might be more or less up-to-date than your special phone book organized by phone number. Such directories contain duplicate information, which often leads to inconsistencies and out-of-date information. Also, such directories are usually not readily available, and they are usually expensive. The types of data organization that can be supported are limited. They are also limited by the nature of the medium on which the directories are distributed (e.g., paper) and by the capabilities of their end users (people without specialized training, perhaps). By contrast, online directories can support several kinds of data organization simultaneously . The online analogy to your printed phone book can easily let you search by name, phone number, address, or other information. Furthermore, online directories can provide more-advanced types of searches that would be difficult or impossible to provide in printed form. For example, if you are not sure of the spelling of a name, an online directory can let you search for names that sound like the one you provide. It can also provide searches based on common misspellings, substrings of names , and other variations. These different kinds of searches can be performed simultaneously or in some defined order (for example, an exact search first, then a sounds-like search, then a substring search, and so on) until a match is found. This kind of power in searching is key to providing users with the kind of "do what I mean" behavior they often desire . Directories Can Be SecureOffline directories offer little, if any, security. The phone book, for example, is public. Your company's printed internal phone book may have "do not distribute outside the company" stamped on it in big red letters , but this kind of security is advisory at best. This lack of security reduces the number of applications that can be served by an offline directory. It also forces users to make difficult choices, if any choice is available to them at all. Most people are familiar with unlisted phone numbers, a service most phone companies offer for a premium fee. Opting out of the directory makes your number unavailable to telemarketers and other annoying callers . However, it also makes your number unavailable to people you probably want to have it. The root of this problem is the lack of any security in an offline directory. Its information is accessible to anybody with access to the directory, or information can be left out of the directory and accessible to nobody. This is a natural consequence of the methods used to distribute and access offline directories. Distribution is often very wide, and everybody gets his or her own copy. The access method consists of flipping through pages or calling a public number, such as 411. None of these methods provide any way of determining who is accessing the directory and, therefore, what information they should have access to. Online directories can solve these problems. Online directories centralize information, allowing access to that information to be controlled. Clients accessing the directory can be identified through a process called authentication . The directory can use the identity established in conjunction with access control lists (ACLs) and other information to make decisions about which clients have access to what information in the directory. Returning to our phone book analogy, consider how security features such as ACLs would change the situation. You could be listed in the directory, but your information would be accessible only to a subset of directory clients. You might be able to specify this subset as a list of friends . You might be able to specify it via some criteria, such as " anyone who lives on my block." You could allow your information to be available to everyone except a list of people you specify. The possibilities go on, and the results are quite powerful. It's important to realize that even this level of powerful and flexible security is not a panacea. For example, ACLs can be effectively, if somewhat awkwardly, defeated by a trusted user copying confidential information off of his or her screen and distributing it outside the company. Still, online directories have security capabilities that are far more advanced than those of offline directories. Directories Can Be PersonalizedAnother difference between printed directories and online directories is the degree to which each can be personalized. There are two aspects to this personalization:
TV Guide and the phone book are personalized on a regional basis. But everyone gets the same LL Bean catalog and accesses the same card catalog at the library. Furthermore, everyone within the same region gets the same phone book or TV Guide . It would be nice to get catalogs tailored to your specific interests, a phone book organized to do searches in the way you prefer, or a card catalog that remembers the kinds of books you like. This is the first aspect of personalization: the ability to deliver information tailored to your needs as an information consumer. The second aspect of personalization concerns your ability to determine who has access to information about you and other things. This is your ability to tailor the directory to your needs as an information provider. In offline directories, as we saw previously, you have only two broad choices about the accessibility of directory information about yourself: You can either be included in the directory or not ”with no in-between. Furthermore, many directories do not even provide you with this choice. Trying to get yourself unlisted can be a frustrating and time-consuming experience. Online directories offer both of these features. The mechanism for doing so is rooted in the directory security capabilities described previously. By identifying users who access the directory and storing profile information about them, an online directory can easily provide personalized views of the directory to different users. For example, an online catalog can show you the types of products you are most likely to be interested in. This personalized service could be based on interests explicitly declared by you. It could also be based on your previous interactions with the service. From a user's perspective, personalization of this kind is great because it gives the user a more desirable service. The user does not need to wade through information that is of less interest just to get to the information the user does consider interesting. From a service provider's perspective, personalization of this kind is great because it provides a more desirable service to the service provider's users. It also allows the service provider to better target all kinds of special services. For example, the service provider can provide information about promotions and sales, new product offerings, and advertisements, all tailored to a user's preferences. Directory DescribedSo far we've been relying primarily on a common-sense understanding of the word directory in our discussion. We've used everyday printed directories that you are probably familiar with to explain what online directories are and how they differ from those offline. Now it's time to glean from our previous discussion the defining characteristics of online directories. The definition we will give is not a formal or mathematical one. Instead, we will expound on a list of characteristics that online directories share. Design Center Defined We use the term design center to refer to the defining set of assumptions, constraints, or criteria driving the design or implementation of a system. When designing or implementing a system, you have to make all kinds of decisions about what's important, what's not, what the system must do well, and what it can afford to do less well. A system's design center is an expression of the focus the designer or implementer had when making these decisions. Design center is a concept that applies to software and other systems and products as well. For example, suppose you were going to design and implement a vehicle for yourself. Aside from needing a few common characteristics that essentially boil down to a wheeled, motorized conveyance, you have a lot of flexibility. A designer who has a large family might design a station wagon or van. His design center might be focused on large passenger capacity. Another designer with a lot of stuff to haul around might design a truck. Her design center might be focused on cargo capacity. Another driving enthusiast designer might focus on performance. Software and service design centers work in similar ways with the following questions. Does the software system or service need to serve a large community or a small one? Is the community technically sophisticated or inexperienced? Is performance a critical feature of the system? Is security? The answers to these questions and others drive the focus of the design and implementation efforts and ultimately determine the character of the system. A directory can be thought of as a specialized database. It is interesting to compare databases and directories, because the differences have more to do with environment and design center than with anything fundamental. The comparison is also interesting because most people generally have a better understanding of what a database is and does than they do a directory. The differences between a database and a directory fall into the following broad categories:
Each of these points is explained in the remainder of this section. Read-to-Write RatioOne defining characteristic of a directory is that it is typically read or searched far more often than it is written or updated. This is quite often not the case with a database. A database might be used to record transaction information or other auditing data that is read only under exceptional, or at least infrequent, conditions. For example, such data might be read only once a month to produce a summary report, or once a year when an internal audit is conducted . Information in a directory, on the other hand, is usually read many more times than it is written. In fact, it is not unusual for a piece of directory information to be read 1,000 to 10,000 times more often than it is written. If you think about the types of information usually stored in a directory, this makes sense. Information about people, for example, changes relatively infrequently, especially compared to the number of times the information needs to be accessed. How often do you change phone numbers compared with the number of times somebody calls you? How often do you change addresses compared with the number of times you receive mail? Data with this "often read, seldom written" characteristic is not restricted to information about people. Catalog data, most location information, configuration information, network routing information, reference information, and many other types of information are all read far more often than they are written. The domain of applications that can be served by a directory is quite large. For some applications, the information is never updated online; instead, it is updated only periodically via some batch process initiated by an administrator. Why is this characteristic important? It sets a design center for directory implementations. Implementers can make important, simplifying design decisions based on this characteristic. Directory implementations can be highly optimized for the types of operations that will be performed most often. If one operation is performed 10,000 times more often than another, it's a good idea to spend more time making that operation perform quickly. Contrast this with databases, which must be optimized for write and read operations. This kind of optimization has implications on other directory features ”such as replication ”which we will discuss later. Information ExtensibilityAnother important, defining characteristic of a directory is that it supports information extensibility. The term directory schema refers to the types of information that can be stored, the rules that information must obey, and the way that information behaves. Directories are not limited to a fixed set of schema that can be stored and retrieved. This information can be extended in response to new needs and new applications. A directory usually comes with a useful set of predefined types of information that can be stored, but many installations have special requirements that dictate the extension of this predefined set. Your organization may have special attributes you want to store, including, for example, employee status for people or the building location code for a printer. Sometimes these new attributes may even define new kinds of behavior from an existing attribute. Although databases are used to store many kinds of information organized in all kinds of ways, they are usually constrained in the types of information that can be stored. It is rare to find a database that allows you to introduce a new, primitive data type with new semantics. Data DistributionDistribution of data is another area in which directories differ from databases. Data distribution refers to the placement of information in servers throughout your network. Data can be centralized in a single server, as shown in Figure 1.2, or data can be distributed among several servers, as shown in Figure 1.3. Figure 1.2 Centralized directory data held in a single server.Figure 1.3 Distributed directory data held in three servers.Although you can find databases that allow limited distribution of data, the scale of the distribution is quite different. The typical relational database allows you to store one table over here and another table over there. This distribution is usually limited to a few sites. The ability to make queries that involve both of these sites exists, but performance is often a problem. This causes the distribution features to be rarely used. Data distribution is a fundamental factor in the design of directories. Part of the directory's purpose is to allow data to be distributed across different parts of your network. This capability is aimed at addressing environments where authority and administration must be distributed. An example of an organization needing this kind of distribution is one with offices in several countries around the world. Each office wants to have authority over its own directory; thus, the country-specific directories must appear to the outside world as a single, logical directory for the organization as a whole. Another example in which data distribution is important is in support of large-scale directories. As your directory gets bigger, at some point the tactic of buying a bigger server with more disk and memory and CPU horsepower produces diminishing returns. A better approach may be to construct your directory from a set of smaller machines that work together to provide the overall service. This solution is cheaper in many cases. It has the advantage of harnessing the parallel processing power of all the machines holding the directory. It also has certain attractive practical implications on the performance of some system administration functions, such as performing backups , recovering from disasters, and so on. Consider a directory distributed across ten small machines: Backing up or recovering one of the small machines is easier than backing up or recovering a single large machine. Data ReplicationClosely related to data distribution is the topic of replication. Replication is the process of maintaining multiple copies of directory data at different locations. There are a number of reasons to do this:
More-detailed information on replication can be found in Chapter 10, "Replication Design." Databases sometimes support replication, but typically they do so only for a very small number of replicas. Historically, performance has been a big problem with database replication implementations. This is partly because database replication is almost always strongly consistent; that is, all copies of the data must be in sync at all times. Directory replication, on the other hand, is almost always loosely consistent. This means that temporary inconsistencies in the data contained in different replicas are acceptable. This characteristic has important implications for the number of replicas that directories can support and the physical distribution of those replicas across the network. As we shall see later, performance is an important directory characteristic. One good way of helping to ensure great performance is to make sure that each user of the directory has a copy of it close by. There are two reasons for this:
Availability of the directory is also a key factor. Directories tend to be used by many different applications for such fundamental purposes as authentication, access control, and configuration management. The directory must always be available to these applications if they are to function at all. It is important to note that availability is not the same thing as reliability. A reliable directory may have redundant hardware and an uninterruptible power source. Such a directory may almost never go down, but that does not mean that it is always available to the clients that need to access it. For example, entire networks between clients and servers might go down. From the client's perspective, this causes the same problem as the directory going down. You could try to solve this problem by building into your network the same kind of hardware reliability that is available for servers. Redundancy, uninterruptible power, and other techniques are all valuable , although not always practical. The other approach is to replicate your directory data to bring the data closer to the clients needing access to it. This helps to mitigate network problems that might otherwise prevent clients from accessing the directory. A sample unreplicated scenario is shown in Figure 1.4, and a sample replicated scenario is shown in Figure 1.5. Figure 1.4 An unreplicated directory service with data held by only one server.Figure 1.5 A replicated directory service with data held by three servers.There are several implications of these facts on directory replication. Directories are replicated on a far greater scale than databases. It is not unusual for a directory replica to be maintained on each subnet in your network to minimize latency and increase availability. In some cases, a replica might be maintained on each machine, which can lead to literally hundreds or thousands of replicas. These replicas may be many network hops away from the central directory. They may even be connected over links that are only up intermittently. These kinds of replication requirements set directories apart from databases. PerformanceAs mentioned previously, high performance is another characteristic that differentiates directories from databases. Database performance is typically measured in terms of the number of transactions that can be handled per second. This is also an important measure of directory performance, but the requirements on a directory are far more stringent than on most database systems. A typical large database system might handle hundreds of transactions every second. The aggregate directory performance required by a typical large directory system may be thousands or tens of thousands of queries per second. These queries are usually simpler than the complex transactions handled by databases. As described earlier, the read-to-write ratio is typically much higher on a directory than on a database. Therefore, update performance is not as critical for directories as for databases. As we shall see later, though, it is important nonetheless. Some of the directory's increased performance requirements are caused by the wide variety of applications that use the directory. Whereas a database may be designed and deployed with a single or a small set of driving applications in mind, directories are often deployed as an infrastructure component that will be used by an unknown but continually increasing number of applications developed across your company, and even across the Internet at large. Access to the directory is distributed, as is the development of the applications causing this access. This means that you, as the directory administrator, often do not have control over the kinds of queries your directory must answer. Therefore, it is important that your directory be flexible and capable of good performance regardless of the types of queries it must respond to. Another root of directory performance requirements is the types of applications that typically access the directory. Applications access the directory for many different purposes. If your directory is used by your email software to route email, for example, one or more directory lookups are required for each piece of mail. Depending on the volume of mail your site processes, this can be a significant load on the directory. There are many more examples that require high performance. If your directory is used by Web application software as an authentication database, it is accessed each time a user launches a new application. If your directory is used by these applications to store user preference and other information needed to provide location independence, even more directory accesses are called for. If your directory is used to store configuration and access control information for your Web, mail, and other servers, there is a potential directory access each time those services are accessed by clients. If you have a large user population, this quickly adds up to a lot of traffic. In these environments, using directory locality to minimize network latency is critical to providing adequate performance. As you can see, directories are at the center of a lot of things that cause performance requirements to increase quickly. Of course, client-side caching can and should be used to minimize the number of times the directory itself is accessed, but even these techniques can only slow the flow of directory queries. High performance is still one of the most important characteristics of a directory. Earlier we stated that the read-to-write ratio for directories is very high. The natural conclusion you could draw from this is that write performance is not nearly as important as read and search performance. Although this is true in a way, the scale of data handled by many directories makes write performance an important factor as well. And, as we described earlier, the capacity for online updating is one of the key enablers of some exciting new online directory applications. Clearly, the ability to update is important, and it must function at a certain level of performance. For example, consider a directory with a million entries. This may seem like a lot, but this is not unreasonable for a very large corporation (after you're finished adding entries for all users, groups, network devices, external partners , customers, and other things). If each entry changes only once a month on average, that is a million updates per month, 250,000 updates per week, almost 36,000 updates per day, or around 1,500 updates per hour . That's quite a few updates! And the peak number of updates that must be handled is much higher because user-initiated changes are usually made during business hours. Administrator-initiated changes may need to be saved up and applied in a batch during limited off-peak hours, further increasing performance requirements. Standards and InteroperabilityThe last important factor sets directories apart from databases is standards. The database world has various pseudo-standards, from the relational model itself to SQL. These pseudo-standards make it easier to migrate from one database system to another. They also make it so that when you've learned the concepts behind one vendor's system, you can easily apply that knowledge to come up to speed on another's quickly. These standards do not provide real interoperability, however. In the directory world, because applications from any vendor must be able to use the directory, real interoperable standards are critical. This is where LDAP comes in. LDAP provides the standard models and protocols used in today's modern directories. LDAP makes it possible for a client developed by Microsoft to work with a server developed by Netscape, and vice versa. LDAP also makes it possible for you to develop applications that can be used with any directory. In the database world, an Oracle application cannot be used with an Informix database. An Informix application cannot be used with a Sybase database. This kind of interoperability, lacking in databases, is important to directories for two reasons:
Before LDAP came along, each application that needed a directory usually came with its own directory built right in. This may seem a convenient solution at first glance, but consider what things are like when you've installed your 24th application and, therefore, your 24th directory. Each user in your organization who requires access to these applications needs an entry in each directory ”a lot of duplicate information to maintain. This is one of the primary sources of headaches for system administrators and increased costs for IT organizations. This situation is illustrated in Figure 1.6. Figure 1.6 Application-specific directories cause duplicate information and system administration headaches.Application developers everywhere can write applications using the standard directory tools of their choice. These applications will run with any LDAP-compliant directory, which essentially turns the directory into a piece of network infrastructure. This dramatically increases the number of applications that can and will be written to take advantage of the directory. It also frees you from having to rely on a single vendor for your directory solution. These same advantages are what drove the success of other Internet protocols, such as HTTP (for the Web), IMAP (for accessing email), and even TCP/IP itself. A standards-based directory infrastructure is illustrated in Figure 1.7. Figure 1.7 A standards-based, general-purpose application directory eliminates information duplication.Directory Description SummaryHere is a reasonably concise description to summarize a directory: It is a specialized database that is read or searched far more often than it is written to. A directory usually supports storing a wide variety of information and provides a mechanism to extend the types of information that can be stored. Directories can be centralized or distributed. They are often distributed in large scale, both in how and where information is distributed. Directories are usually replicated so that they are highly available to the clients accessing them. The scale of directory replication often involves hundreds, if not thousands, of replicas. Replication also helps increase directory performance, which is important to providing applications with a fast, reliable infrastructure component that can be used with confidence. Finally, with LDAP, directories have become standardized. This allows applications and servers from different vendors to be developed, sold, and deployed independently.
|
Index terms contained in this sectionACLs(access control lists) 2nd application-specific directories 2nd authentication process online directories centralized directory data in a server data distribution in directories 2nd replication in directories 2nd 3rd describing directories 2nd design center directories 2nd directories ACLs (access control lists) 2nd application-specific 2nd centralized data in single server data distribution 2nd data replication 2nd 3rd describing 2nd description summary 2nd design center 2nd directory schema dynamic 2nd everyday flexible flexible content 2nd flexible organization 2nd general-purpose, standards-based hardware reliability information extensibility 2nd interoperability 2nd LDAP 2nd NOS (network operating system) offline security static content online 2nd authentication process data distribution 2nd data replication 2nd 3rd describing 2nd description summary 2nd design center 2nd directory schema flexible content 2nd flexible organization 2nd information extensibility 2nd interoperability 2nd performance 2nd 3rd personalizing 2nd read-to-write ratio 2nd security 2nd standards 2nd updating 2nd 3rd performance 2nd 3rd personalizing 2nd purpose-specific read-to-write ratio 2nd replicated directory service with data in three servers security 2nd standards 2nd unreplicated directory service with data in one server dynamic directories 2nd everyday directories flexible directories flexible-content directories 2nd flexible-organization directories 2nd general-purpose directories hardware reliability for online directories information extensibility directories 2nd interoperability of directories 2nd LDAP directories 2nd networks NOS (network operating system) directories NOS (network operating system) directories offline directories security static content online directories 2nd ACLs (access control lists) 2nd authentication process centralized data in single server data distribution 2nd data replication 2nd 3rd describing 2nd description summary 2nd design center 2nd directory schema flexible content 2nd flexible organization 2nd hardware reliability information extensibility 2nd interoperability 2nd LDAP 2nd performance 2nd 3rd personalizing 2nd read-to-write ratio 2nd replicated service with data in three servers security 2nd standards 2nd unreplicated service with data in one server updating 2nd 3rd organization flexible of online directories 2nd performance of directories 2nd 3rd personalizing directories 2nd purpose-specific directories read-to-write ratio directories 2nd replicated directory service with data in three servers replication of data directories 2nd 3rd schema of directories secure directories 2nd security directories online 2nd offline directories online directories authentication process servers directory data centralized directory service replicated unreplicated standards of directories 2nd standards-based directories static-content offline directories summaries of directory descriptions 2nd unreplicated directory service with data in one server updating directories online 2nd 3rd |
2002, O'Reilly & Associates, Inc. |