Windows User Group.ppt

Windows User Group Active Directory Objectives Where did Active Directory come from Why is AD the way it is What is AD fundamentally What does this mean to you Where is AD going Agenda Directory Services History What is Active Directory How to implement AD Active Directory Futures Windows 2003 R2 Active Directory Federation Services Security Identity - The catalog of what you have and who you are Authentication – How do you know that someone is who they claim to be What you are What you have What you know Authorization – What can they do? Auditing – Who did what? Directory Services External (Public) Directories X.500 (de jure) DNS (de facto) RFC 2247 PKI (not a DS but here for discussion) Internal Directories IBM Mainframe (eg RACF, NetBIOS) UNIX (e.g. Host file, NIS, YP) Novell Bindery/NDS Banyan StreetTalk LDAP Active Directory Design Goals Maintain Download compatibility with NetBIOS domains Utilize Kerberos Realms as the primary native namespace Utilize LDAP as the access/query protocol Support PKI Dynamically extensible Performance/cost RFC 2247 is the Key X.500 never achieved global operational stability DNS became the defacto global naming standard RFC 2247 mapped the X.500 naming standard into the DNS nomenclature Administrative boundaries moved from the OU (x.500) to the DC (DNS). This is a point of contention with x.500-based directory services to this day. The Domain Component mapped directly into the kerberos realm and NetBIOS Domain namespace model. NetBIOS Shortnames became the Relative Distinguished Name (RDN) PKI Security boundaries mapped into the DC authority level. PKI cross-signed trusted mapped into the inter-domain trust model. Active Directory Functional Components Database Optimize for queries Efficient use of space (sparse data) Replication Engine Protocol Headers NetBIOS LDAP DAP Kerberos PKI other Management Interfaces AD Database Issues Database structure Bootstrapping Attribute granularity Attribute-level permissioning Multi-valued