= Overview of Enterprise Directory Architecture =
    Original author:  Beth Merce - 20081031

The University of Alaska Enterprise Directory and Authentication Service are comprised 
of the following:

	iPlanet Directories (EDIR directory)

		iplanet UNIX account

		source of information for web gateways
		source of identity for authentication service
		enforces uniqueness 
		   (BannerID, UASystemID, UASystemLegacyID, UID and mailAlternateAddress)
		enforces limited password logic 
		   (age, length, composition, reuse)
		contains plugin for kerberos authentication

		3 instances; Test, Prep, Prod
		on 4 servers; eklutna, egegik, edgar, elias
		(soon to be 5th server; elfin)


	Oracle Databases (EDIR "registry")

		sxldap UNIX account and OPS$SXLDAP schema 

		superset of directory data
		reconciliation of entities from various systems of origin 
		   (primarily Banner)
		enforces business logic 

		3 instances; RPTT, RPTQ, RPTS
		on 1 server; summit


	Web Gateways

		ldapgw UNIX account for EDIR/AUTHSERV
	
		AUTHSERV: web authentication service and interface to security related functions;
		also interface to kerberos password/account management for kerberized directory records
		(e.g. password changes/resets, locking/unlocking accounts, creating guest accounts, etc.)

		EDIR:     white pages and interface to self service updates 

		iplanet UNIX account for UPDATE

		UPDATE:   interface called by both EDIR and AUTHSERV to perform directory updates

		3 instances each; Test, Prep, PROD
		on 4 servers; eklutna, egegik, edgar, elias
		(soon to be 5th server; elfin)


	Equalizer 

		load balancing for DNS names

			edirtest.alaska.edu
			edirprep.alaska.edu
			edir.alaska.edu

			authservtest.alaska.edu
			authservprep.alaska.edu
			authserv.alaska.edu

			email-lookup.alaska.edu

		for http/https ports
		for ldap/ldaps ports

	Kerberos Realm

		oitsynch UNIX account

		password store behind iPlanet Directory
		directory plugin implements kerberos authentication during directory bind
		UPDATE interface behind AUTHSERV implements kerberos password reset/change/lock/unlock functionality

		3 realms: test.alaska.edu, prep.alaska.edu, prod.alaska.edu
		1 each on 3 servers: cisca, cobalt, cupola

#######################
DOCUMENT CHANGE HISTORY

20081031 elm	corrected typos

(eof)