Changes between Initial Version and Version 1 of ALL__architecture

Timestamp:

11/14/14 15:23:45 (10 years ago)

Author:

lttoth@…

Comment:

--

ALL__architecture

@@ +1 @@
+= Overview of Enterprise Directory Architecture =
+    Original author:  Beth Merce - 20081031
+
+The University of Alaska Enterprise Directory and Authentication Service are comprised 
+of the following:
+
+        iPlanet Directories (EDIR directory)
+
+                iplanet UNIX account
+
+                source of information for web gateways
+                source of identity for authentication service
+                enforces uniqueness 
+                   (BannerID, UASystemID, UASystemLegacyID, UID and mailAlternateAddress)
+                enforces limited password logic 
+                   (age, length, composition, reuse)
+                contains plugin for kerberos authentication
+
+                3 instances; Test, Prep, Prod
+                on 4 servers; eklutna, egegik, edgar, elias
+                (soon to be 5th server; elfin)
+
+
+        Oracle Databases (EDIR "registry")
+
+                sxldap UNIX account and OPS$SXLDAP schema 
+
+                superset of directory data
+                reconciliation of entities from various systems of origin 
+                   (primarily Banner)
+                enforces business logic 
+
+                3 instances; RPTT, RPTQ, RPTS
+                on 1 server; summit
+
+
+        Web Gateways
+
+                ldapgw UNIX account for EDIR/AUTHSERV
+        
+                AUTHSERV: web authentication service and interface to security related functions;
+                also interface to kerberos password/account management for kerberized directory records
+                (e.g. password changes/resets, locking/unlocking accounts, creating guest accounts, etc.)
+
+                EDIR:     white pages and interface to self service updates 
+
+                iplanet UNIX account for UPDATE
+
+                UPDATE:   interface called by both EDIR and AUTHSERV to perform directory updates
+
+                3 instances each; Test, Prep, PROD
+                on 4 servers; eklutna, egegik, edgar, elias
+                (soon to be 5th server; elfin)
+
+
+        Equalizer 
+
+                load balancing for DNS names
+
+                        edirtest.alaska.edu
+                        edirprep.alaska.edu
+                        edir.alaska.edu
+
+                        authservtest.alaska.edu
+                        authservprep.alaska.edu
+                        authserv.alaska.edu
+
+                        email-lookup.alaska.edu
+
+                for http/https ports
+                for ldap/ldaps ports
+
+        Kerberos Realm
+
+                oitsynch UNIX account
+
+                password store behind iPlanet Directory
+                directory plugin implements kerberos authentication during directory bind
+                UPDATE interface behind AUTHSERV implements kerberos password reset/change/lock/unlock functionality
+
+                3 realms: test.alaska.edu, prep.alaska.edu, prod.alaska.edu
+                1 each on 3 servers: cisca, cobalt, cupola
+
+#######################
+DOCUMENT CHANGE HISTORY
+
+20081031 elm    corrected typos
+
+(eof)