LDAP Directory Services (LDS)

This section contains the following topics:

How LDS Works

Commands Valid for LDS

Implement LDS

Records and Options Summary

TSSLDS Server Subtask

How LDS Works

An LDAP directory:

Provides directory information in a central location
Can be used as a network‑accessible database to organize and index network security information

The LDAP Directory Services (LDS) option allows security information to be directly accessible through LDAP compliant directory enabled applications.

Use LDS to provide:

Centralized control of security information
Enhanced flexibility by supporting all network operating systems
Consistency across the enterprise

CA Top Secret acts as an application client that uses an LDAP Application Program Interface (API) to format and communicate a request to the LDAP server. The CA Top Secret interface establishes a connection and communicates to the LDAP server through TCP/IP. Servers enabled with Secure Sockets Layer (SSL) technology protect unauthorized parties from viewing sensitive information during a secure session.

LDS runs in the CA Top Secret address space and requires additional CPU cycles to process the data. For example, 1,000 commands for security changes to 5 nodes results in 5,000 commands.

Commands Valid for LDS

Administrative commands that create, modify, and delete ACIDs are valid for LDS. This includes CREATE, ADD, REPLACE, and DELETE of ACID records as well as password changes during system validation. The PERMIT and REVOKE commands are not valid for LDS and are not transmitted to LDAP servers.

Important! Use SSL if you are using LDS to propagate highly sensitive information.

Implement LDS

To implementing the CA Top Secret LDS component:

Create the LDS Journal file
Create the LDS Recovery file
Create the NDT LDAPNODE records
Create NDT LDSYSID options record
Set up SSL definitions
Define XREF field mapping for NDT LDAPNODE records
Add LDS attribute to valid ACID records
Add LDAPDEST list to valid ACID records
List LDS definitions to validate setup
Modify LDS Control Option to start LDS processing

Records and Options Summary

The record fields are:

NDT: This record ID contains LDAP server information and field mapping and LDS global options.
Control Options: This record ID defines global options available. The LDS parameter indicates that the LDS interface can be used.
LDAPNODE XREF: This record ID allows unique mapping of LDAP attributes to CA Top Secret ACID fields for each LDAP server.

NDT defined global options override static global options, which are specified in the startup control options file.