Typical Directory Implementations at Institutions in Higher - - PowerPoint PPT Presentation
Typical Directory Implementations at Institutions in Higher Education Brendan Bellina Brendan Bellina Identity Services Architect Identity Services Architect Mgr, Enterprise Middleware Development Mgr, Enterprise Middleware Development
Brendan Bellina Brendan Bellina Identity Services Architect Identity Services Architect Mgr, Enterprise Middleware Development Mgr, Enterprise Middleware Development Information Technology Services Information Technology Services University of Southern California University of Southern California Los Angeles, California, USA Los Angeles, California, USA bbellina@usc bbellina@usc. .edu edu
2
3
4
5
6
7
8
9
10
11
12
13
14
15
User Info LDAP-enabled Application LDAP Service accounts Because an Enterprise Directory contains all people who use all applications and all their attributes, population and attribute filtering must be done between the application and the directory. LDAP-enabled applications should use assigned LDAP Service accounts to filter based on directory ACI’s.
LDAP Directory
System of Record System of Record System of Record LDAP-enabled Application Groups
16
# Allow all access to the Directory Administrators Group
aci: (targetattr ="*")
(version 3.0;acl "Directory Administrators Group";
allow (all) (groupdn = "ldap:///cn=Directory Administrators, dc=usc,dc=edu")
;
)
#
17
18
19
20
21