Glossary

Access Control Instruction (ACI)

An instruction that grants or denies permissions to entries in the directory server.

Access Control List (ACL)

Data associated with a file, directory, or other resource that defines the permissions that users, groups, processes, and devices have for accessing it.

Access Control Rule (ACR)

Collective permissions and bind rules that are set as a pair.

ACI

See Access Control Instruction.

ACL

See Access Control List.

ACR

See Access Control Rule.

Active Directory

Microsoft's directory service used by the core operating system to store user account and system resource data and by the BackOffice suite of products as their data store.

administration domain

A domain that allows a common login to work across several servers.

AFS

Andrew File System an enterprise-type file system that enables systems to share files and resources across local and wide area networks. It uses a clientserver architecture for file sharing.

ASN.1

Abstract Syntax Notation One (ASN.1) describes objects within a management information database.

attribute

Each LDAP entry consists of a number of named attributes, each of which has one or more values.

authentication

The means by which a server verifies a client's identity.

Backup Domain Controller (BDC)

A backup mechanism that maintains a read-only copy of the SAM database.

base DN

The distinguished name (DN) where part of the directory information tree (DIT) is rooted. Sometimes indicated as baseDN.

BDC

See Backup Domain Controller.

Blowfish cyptography

A secret key cryptography that uses a variable key lengths of 32448 bits.

Broadcast method

A way in which to locate an NIS server to bind to. The method sends out a broadcast message and binds to the first server that responds.

CA

Certificate Authority. A trusted third party that issues digital certificates.

cipher

Encoded character or characters

cipher text

Data that has been coded ( enciphered , encrypted, encoded) for security purposes.

cipher strength

Number of bits in the key used to encrypt data.

Cold Start File method

A way to provide a file to a client. The method contains information about how to locate directory objects and also a set of credentials. This is the preferred NIS+ method because it provides additional security.

CRAM-MD5

One of the SASL mechanisms (RFC 2222) that was at one point proposed as a required mechanism for LDAP v3. CRAM stands for Challenge Response Authentication Mechanism. It uses the MD5 (message digest 5) hash algorithm developed by Ron Rivest for generating a message digest, which in turn is used for authentication.

credentials

Authentication information that the client software sends with each request to a naming server to verify the identity of the user or machine.

cryptography

Conversion of data into a secret code for transmission over a network. The original data is converted into ciphertext (a coded equivalent) with an encryption algorithm. The ciphertext is decoded at the receiving end and turned back into the original form.

DAP

Directory Access Protocol (X.500).

Data Encryption Standard (DES)

A commonly used, highly sophisticated algorithm developed by the U.S. National Bureau of Standards for encrypting and decrypting data.

DEN

Directory Enabled Networks.

DES

See Data Encryption Standard.

DHCP

See Dynamic Host Configuration Protocol.

Diffie-Hellman

Cryptography that enables exchange of public keys using shared secret keys at both ends.

DIGEST-MD5

The Digest-MD5 mechanism is described in RFC 2831. In Digest-MD5, the LDAP server sends data that includes various authentication options that it is willing to support plus a special token to the LDAP client. The client responds by sending an encrypted response that indicates the authentication options that it has selected. The response is encrypted in such a way that proves that the client knows its password. The LDAP server then decrypts and verifies the client's response.

Directory Information Tree (DIT)

An arrangement of directory entries in a treelike structure.

directory naming context

A method to map to the DNS domain name of a company and its subdomains. Termed Active Directory by Microsoft.

directory service

A specific type of naming service in which the objects bound to names are directory entries.

Directory Server Entry (DSE)

A naming context that defines the root entry of the directory server.

Directory System Agent (DSA)

The core program of Microsoft's Active Directory implementation.

Distinguished Name (DN)

A unique identifier of each entry in the DIT.

DIT

See Directory Information Tree.

DN

See Distinguished Name.

DNS

See Domain Name System.

domain forests

A set of domains or domain trees that do not form a contiguous namespace, but they do have an implicit trust relationship among them.

Domain Name System (DNS)

A method to solve the problem of locating computers on ArpaNet, the forerunner of the Internet. DNS is the de facto standard naming service of the Internet.

domain trees

A set of domains that form a contiguous namespace through a set of hierarchal relationships.

DSA

Directory Services Agent.

DSE

See Directory Server Entry.

DSML

Directory Service Markup Language A set of XML tags that define the contents of a directory. Developed by Bowstreet Software, it is designed to allow directories to work together.

Dynamic Host Configuration Protocol (DHCP)

A procedure by which IP- related information is provided to new clients .

entry

A single row of data in a database table, such as an LDAP element in a DIT.

Extensible Storage Engine (ESE)

A database that has built-in indexing features, along with other database features such as transaction logging and recovery. All Active Directory data resides in this database.

flat namespace

An area (domain) in which one NIS domain is not related to another.

Global Catalog

A list that provides a way to centrally maintain information about users and universal groups for access control.

GMT

Greenwich Mean Time.

GSSAPI

Generic Security Service Application Programming Interface. Used to provide a standard interface to different authentication methods .

heartbeat signal

Client access to the directory service itself. If the heartbeat or communication channels fail, then the cluster will not function properly.

HTTP

Hypertext Transport Protocol.

IANA

Internet Assigned Numbers Authority.

Indexed Sequential Access Method (ISAM)

A database modeled after the ESE and similar to the one in which Microsoft Exchange stores data.

IMAP

Internet Message Access Protocol standard mail service protocol that provides a message store that holds incoming email.

ISO

International Standards Organization.

J.N.D.I.

Java Naming and Directory Interface.

KCC

See Knowledge Consistency Checker.

KDC

See Key Distribution Center.

Kerberos

A network authentication protocol that provides strong authentication for client-server applications by using secret-key cryptography.

Key Distribution Center (KDC)

A clearinghouse required by Kerberos.

KM

See Knowledge Module.

Knowledge Consistency Checker (KCC)

An Active Directory process that is responsible for mapping out the Active Directory domain controller topology and determining how replication should be performed.

Knowledge Module (KM)

A utility that monitors the iPlanet Directory Server. KM continually monitors and automatically reacts to critical infrastructure information.

LAN

Local area network

LDAP

Lightweight Directory Access Protocol. The newest addition to the list of Solaris OE naming services. It is an optional naming service that can coexist with legacy Solaris OE naming services. LDAP shares some characteristics with NIS and NIS+, but it is more sophisticated in how stored data is structured and accessed.

LDAP access model

A model that defines how LDAP clients communicate with LDAP servers.

LDIF

See LDAP Data Interchange Format (LDIF)

LDAP Data Interchange Format (LDIF)

A directory server uses the LDAP Data Interchange Format (LDIF) to describe a directory in text format. LDIF is often used to build a directory database. It is also a common method used for importing data from legacy data sources such as NIS maps, and to add large numbers of entries to the directory all at once.

LDAP information model

A model that defines how entries are organized in a directory.

LDAP naming model

A model that defines how objects are named and the type of information which can be stored in the directory.

LDAP referral

A mechanism used to instruct an LDAP client searching the directory to continue the search on another directory server.

LDAP replication model

The mechanism by which directory data is automatically copied from one directory server to another. Using replication, you can copy everything from entire directory trees to individual directory entries between servers.

LDAP security model

A model that defines how information in the directory is protected from unauthorized access.

LDIF

See LDAP Data Interchange Format.

Lightweight Directory Access Protocol

See LDAP.

Management Information Base (MIB)

A data structure used to define network devices and objects that SNMP accesses .

naming service

In a general sense, a facility that organizes and names objects. It provides an association, often referred to as a binding, between a name and an object.

NDS

Netware Directory Server.

Network Information Service

See NIS.

Network Information Service +

See NIS+.

NIS

The first UNIX-based distributed naming service. It replaced text files as the repository for storing information.

NIS+

A successor to NIS that corrected a number of flaws in the NIS architecture.

NMS

Network Management Servers

NTLM

A SAM agent that provides backward compatibility to Windows clients by using NT Lan Manager (NTLM) style authentication.

Object Identifier

A number assigned to child object classes to ensure they will not conflict with another object class.

OID

See Object identifier.

OSI stack

Open Systems Interconnection that allows network devices to read, write, and act upon management data.

PAM

See Pluggable Authentication Module.

PDC

See Primary Domain Controller.

performant

An adjective meaning good performance potential.

Pluggable Authentication Module (PAM)

A framework that allows new authentication technologies to be "plugged in" without changing commands such as login , ftp , and telnet .

Primary Domain Controller (PDC)

A controller that has write privileges on the SAM database.

private key

The private component of a pair of mathematically generated numbers, which, when combined with a private key, generates the DES key. The DES key in turn is used to encode and decode information. The private key of the sender is only available to the owner of the key.

public key

The public component of a pair of mathematically generated numbers, which, when combined with a private key, generates the DES key. The DES key in turn is used to encode and decode information. The public key is available to all users and machines.

PSL

A language that enables users to write their own KMs.

QFS

Quick File System, a standalone file system that reduces bottlenecks by maximizing the performance of the file system in conjunction with the underlying disk technology. QFS limits the physical head movement of disks, and provides other state-of-the-art storage technologies.

RAID

Redundant Array of Inexpensive (or Independent) Disks a disk subsystem used to either increase performance, or fault tolerance, or both. RAID is often defined in levels 0 - 6 (plus various level combinations). RAID levels and how they apply to LDAP are covered in Chapter 8 "Selecting Storage for Optimum Directory Server Performance.

RBAC

Role-Based Access Control a methodology or implementation where security is managed in a way that facilitates more granular control of enterprise systems access. Users are assigned one or more roles, and each role is assigned one or more privileges. Security administration with RBAC consists of determining the operations that must be executed by persons in particular jobs, and assigning employees to the proper roles.

RDN

Relative Distinguished Name. The left-most portion of a directory entry name.

Remote Procedure Calls (RPC)

A programming mechanism that enables NIS clients and servers to communicate with each other.

replication

The mechanism by which directory data is automatically copied from one directory server to another.

RFC

Request for Comments, A means by which each distinct version of an Internet standards-related specification is published as part of the RFC document series.

RPC

See Remote Procedure Calls.

SAM

See Security Account Manager.

SAMFS

Storage and Archive Manager File System, a file system originally intended as a disk storage facility supporting SAM (Storage and Archive Manager, tapebased storage). Today, SAMFS is a versatile software package that provides reliable, high performance storage management, archival and retrieval services.

SASL

See Simple Authentication and Security Layer

schema

A set of rules defining what types of data can be stored in any given LDAP DIT.

SDK

Software Development Kit

Secure Socket Layer (SSL)

An authentication method developed by Netscape as a way to create a secure connection between a web client and a web server. It can be used as a transport-layer security mechanism to make application protocols such as LDAP secure.

Security Account Manager (SAM)

A database of user account information maintained on special Windows NT servers called Domain Controllers, of which there are two varieties: primary (PDC) and backup (BDC).

Service Resource Records (SRV RR)

An Active Directory service that clients search to locate the nearest controller.

Service Search Descriptor (SSD)

SSDs define how and where an LDAP naming service client should search for information for a particular service.

shared nothing architecture

An architecture wherein at any time a resource is owned by only one of the cluster nodes.

SID

Security ID. An identification, the generation of which is specific to Microsoft's Active Directory implementation and not a standard LDAP concept.

Simple Authentication and Security Layer (SASL)

A standard proposed for pluggable authentication methods to be used for adding authentication support to connection-based protocols such as LDAP. SASL allows negotiation about multiple authentication schemes between a client and a server. SASL is beneficial as a modular security layer.

Simple Network Management Protocol (SNMP)

A widely deployed protocol originally designed to manage network devices, SNMP can also be used to manage other items such as applications and services.

Single sign-on

The ability to authenticate a user once upon login so that user is automatically authenticated for all applications the user accesses.

SNMP

See Simple Network Management Protocol.

Solaris OE Naming Service Switch

A tool to cope with the coexistence of multiple directory services present in the Solaris operating environment.

Solaris Resource Manager (SRM)

A utility that assigns shares of system resources to different applications, thereby maintaining a minimum threshold of performance.

Specified Server Method

A mechanism that specifies an NIS server or list of servers to bind to.

SQL

Structured Query Language. Standard used for database queries.

SRV RR

See Service Resource Records.

SSL

See Secure Socket Layer.

SSPI

Security Support Provider Interface.

TCP/IP

Transmission Control Protocol/Internet Protocol.

TGT

See Ticket-Granting Ticket.

Ticket-Granting Ticket (TGT)

A Kerberos method for application servers to grant service tickets to an authenticated user.

TLS

See Transport Layer Security.

Transport Layer Security (TLS)

The new standard for secure socket layers . A public-key-based Transport Layer Security protocol.

URL

Uniform Resource Locator

Wide Area Network (WAN)

Wide area network

X.500

A directory service defined as an Open Systems Interconnection (OSI) standard. A precursor to LDAP.