Subject: Re: A different architecture

From: "Tammy Carter" <[email-masked]>
Date: Tue, 03 Nov 1998 16:02:36 -0700

Bill,

Just a clarifying note:  Novell's directory (called NDS) __is__ 
an X.500 directory.

Tammy Green Carter
[email-masked] 

>>> Bill Burr <[email-masked]> 11-2-98 8:30:55 AM >>>
Elliot,

But DNS is a rather specialized sort of directory.  I don't know that it
follows that, because we can build a very specialized global DNS service,
that proves it is practical to build a very general global X.500 directory
service.  Nor does the success of DNS establish that the specific X.500
standard itself is workable on a global scale, or even a local scale.  It
doesn't make a business case for creating a global X.500 PKI directory,even
if we have X.500 directory products that could do the job. It may be that
we should take the contrary lesson: that to be successful, a global service
must be lean and mean and focused, rather than grand and all encompassing.

I don't have any certain answers here.  What bothers me as much as anything
is that PKI seems now to bear the main burden of the X.500 directory.  An
X.509 PKI would be relatively straightforward if there were an in-being
pervasive X.500 directory service, but is PKI a sufficient application to
drive the creation of a global X.500 directory service?  If the main reason
we are building a global X.500 directory service is PKI, maybe there are
simpler solutions.  Perhaps piggybacking on DNS, as Phill suggests, would
be one.

Another somewhat distressing thing is that, while directories seem to be
becoming central to distributed applications, and network operating
systems, they don't seem to be X.500 directories.  Netscape, Microsoft
(with NT 5.0) and Novell all seem to be relying on directories to glue
things together effectively, and hold configuration information.  But I
don't believe that any of them are X.500 directories.  So, in the real
world, most of us are going to have a directory of some sort, but it isn't
necessarily going to be an X.500 directory.  And it isn't obvious how we're
going to chain them all together, or even that we want to.

What does seem to be constant I think, even for "proper X.500" directories,
is some flavor (but which flavor?) of LDAP access.  

It isn't obvious that you want to let outsiders into the Active X
directory, or NDS directory that is near the core of your own system.
Maybe we need separate "border directories" and maybe those could be X.500
directories, all chained together.  But do we then have to maintain two
kinds of directory products, one internal and one external?  And how do we
manage the shadowing of the internal directory by the external directory?
Maybe we can manage this for DoD, or most of the Federal government, but
will the rest of the world go this way?

Another point: the apparatus for X.500 distinguished name assignment and
management, does apparently exist, but it seems to be expensive and few
folks actually seem to know how to get a DN, or to have done it.  Managing
a consistent global DIT for the Federal Gov. seems possible if not trivial,
but can we expand that to the country or the world?  It may be primitive,
in some ways, but the DNS management does exist (although I guess it's
changing a bit), it's cheap to get a domain name, practically any ISP will
do it for you, and even I know how to get one this afternoon, if I want to.

Perhaps the best thing about Phill's proposal, as I understand it, is that
it doesn't really seem to demand or ask anything of the DNS that it isn't
already doing, and it seems like that extra load on the DNS would be very
small.

Maybe the worst thing is accepting Internet domain names as the foundation
of PKI naming.  But perhaps that's also a good thing, in that it is bowing
to reality: on the Internet it is domain names that matter.

Regards,

Bill Burr

At 08:00 AM 11/3/98 -0500, you wrote:
>I think it was on this thread that someone stated that 'we would never have
>a global distributed directory'. But we already have one (DNS), so why is
>it inconceivable that we would have another? I don't advocate stretching
>DNS for this prupose, but it does suggest that we can create global
>directories. Am I missing something here?
>
>Elliott Ginsburg
>
>

---

From: Alan Lloyd <[email-masked]>
Date: Tue, 17 Nov 1998 12:45:02 +1100

Stephen - I think you are to late - Big organisations and the hundreds
if not thousands of people I work with are actually deploying large
scale - application level, business and CA oriented X.500 directory
systems.

If you want the same functionality from DNS as X.500 - one will have to
upgrade it to X.500.
Or one can just put DNS interfaces/servers onto an X.500 system and
migrate DNS to X.500 - see DEN - re DHCP/DNS/RADIUS coupled to X.500.
regards alan

> -----Original Message-----
> From:	Stephen Kent [SMTP:[email-masked]]
> Sent:	Thursday, 5 November 1998 10:20
> To:	Elliott Ginsburg
> Cc:	[email-masked]
> Subject:	Re: Fwd: Re: A different architecture
> 
> Elliott,
> 
> >I'm adding to my own message. Someone also stated on the list that we
> do
> >not want to have a directory between our apps and our PKI services.
> But,
> >again, how often today do we have DNS between our apps and our
> network
> >communication services?
> 
> We already need the DNS to make the existing Internet protocols work.
> In
> many apps, we don't need a directory to support certs/CRLs, so the
> introduction of an additional directory system for that purpose
> introduces
> new failure modes.
> 
> steve