7 Network Working Group C. Weider
8 Request for Comments: 1308 ANS
14 Executive Introduction to Directory Services
15 Using the X.500 Protocol
19 This memo provides information for the Internet community. It does
20 not specify an Internet standard. Distribution of this memo is
25 This document is an Executive Introduction to Directory Services
26 using the X.500 protocol. It briefly discusses the deficiencies in
27 currently deployed Internet Directory Services, and then illustrates
28 the solutions provided by X.500.
30 This FYI RFC is a product of the Directory Information Services
31 (pilot) Infrastructure Working Group (DISI). A combined effort of
32 the User Services and the OSI Integration Areas of the Internet
33 Engineering Task Force (IETF).
37 The Internet is growing at a phenomenal rate, with no deceleration in
38 sight. Every month thousands of new users are added. New networks
39 are added literally almost every day. In fact, it is entirely
40 conceivable that in the future every human with access to a computer
41 will be able to interact with every other over the Internet and her
42 sister networks. However, the ability to interact with everyone is
43 only useful if one can locate the people with whom they need to work.
44 Thus, as the Internet grows, one of the limitations imposed on the
45 effective use of the network will be determined by the quality and
46 coverage of Directory Services available.
48 Directory Services in this paper refers not only to the types of
49 services provided by the telephone companies' White Pages, but to
50 resource location, Yellow Pages services, mail address lookup, etc.
51 We will take a brief look at the services available today, and at the
52 problems they have, and then we will show how the X.500 standard
53 solves those problems.
58 DISI Working Group [Page 1]
60 RFC 1308 Executive Intro to X.500 March 1992
63 2. CURRENT SERVICES AND THEIR LIMITATIONS
65 In the interests of brevity, we will only look at the WHOIS service,
66 and at the DNS. Each will illustrate a particular philosophy, if you
67 will, of Directory Services.
69 The WHOIS service is maintained by the Defense Data Network Network
70 Information Center, or DDN NIC. It is currently maintained at GSI
71 for the IP portion of the Internet. It contains information about IP
72 networks, IP network managers, a scattering of well-known personages
73 in the Internet, and a large amount of information related
74 specifically to the MILNET systems. As the NIC is responsible for
75 assigning new networks out of the pool of IP addresses, it is very
76 easily able to collect this information when a new network is
77 registered. However, the WHOIS database is big enough and
78 comprehensive enough to exhibit many of the flaws of a large
79 centralized database. First, centralized location of the WHOIS
80 database causes slow response during times of peak querying activity,
81 storage limitations, and also causes the entire service to be
82 unavailable if the link to GSI is broken. Second, centralized
83 administration of the database, where any changes to the database
84 have to be mailed off to GSI for human transcription into the
85 database, increases the turnaround time before the changes are
86 propagated, and also introduces another source of potential error in
87 the accuracy of the information. These particular problems affect to
88 different degrees any system which attempts to provide Directory
89 Services through a centralized database.
91 The Domain Name Service, or DNS, contains information about the
92 mapping of host and domain names, such as, "home.ans.net", to IP
93 addresses. This is done so that humans can use easily remembered
94 names for machines rather than strings of numbers. It is maintained
95 in a distributed fashion, with each DNS server providing nameservice
96 for a limited number of domains. Also, secondary nameservers can be
97 identified for each domain, so that one unreachable network will not
98 necessarily cut off nameservice. However, even though the DNS is
99 superlative at providing these services, there are some problems when
100 we attempt to provide other Directory Services in the DNS. First, the
101 DNS has very limited search capabilities. Second, the DNS supports
102 only a small number of data types. Adding new data types, such as
103 photographs, would involve very extensive implementation changes.
105 3. THE X.500 SOLUTION
107 X.500 is a CCITT protocol which is designed to build a distributed,
108 global directory. It offers the following features:
110 * Decentralized Maintenance:
114 DISI Working Group [Page 2]
116 RFC 1308 Executive Intro to X.500 March 1992
119 Each site running X.500 is responsible ONLY for its local part of
120 the Directory, so updates and maintenance can be done instantly.
122 * Powerful Searching Capabilities:
123 X.500 provides powerful searching facilities that allow users to
124 construct arbitrarily complex queries.
126 * Single Global Namespace:
127 Much like the DNS, X.500 provides a single homogeneous namespace
128 to users. The X.500 namespace is more flexible and expandable
131 * Structured Information Framework:
132 X.500 defines the information framework used in the Directory,
133 allowing local extensions.
135 * Standards-Based Directory Services:
136 As X.500 can be used to build a standards-based directory,
137 applications which require directory information (e-mail,
138 automated resources locators, special-purpose directory tools)
139 can access a planet's worth of information in a uniform manner,
140 no matter where they are based or currently running.
142 With these features alone, X.500 is being used today to provide the
143 backbone of a global White Pages service. There is almost 3 years of
144 operational experience with X.500, and it is being used widely in
145 Europe and Australia in addition to North America. In addition, the
146 various X.500 implementations add some other features, such as
147 photographs in G3-FAX format, and color photos in JPEG format.
148 However, as X.500 is standards based, there are very few
149 incompatibilities between the various versions of X.500, and as the
150 namespace is consistent, the information in the Directory can be
151 accessed by any implementation. Also, work is being done in providing
152 Yellow Pages services and other information resource location tasks
155 However, there are some limitations to the X.500 technology as it is
156 currently implemented. One price that is paid for the flexibility in
157 searching is a decline in the speed of the searching. This is because
158 a) searches over a part of the distributed namespace may have to
159 traverse the network, and some implementations cache all the
160 responses before giving them to the user, and b) some early
161 implementations performed search slowly anyway. A second problem with
162 the implementations is that for security reasons only a limited
163 amount of information is returned to the user; for example, if a
164 search turns up 1000 hits, only 20 or so are returned to the user.
165 Although this number is tunable, it does mean that someone with a big
166 search will have to do a lot of work. The performance of the
170 DISI Working Group [Page 3]
172 RFC 1308 Executive Intro to X.500 March 1992
175 Directory, while increasing rapidly in the last two years, is still
176 not able to provide real-time directory services for such things as
177 routing protocols. However, work is being done to speed up service.
179 The X.500 Directory is taking us closer to the day when we will
180 indeed have the entire world on our desktops, and X.500 will help
181 insure that we can find whom and what we need.
183 4: FOR FURTHER INFORMATION
185 For a more detailed technical introduction to X.500 and an extensive
186 bibliography, see "Technical Overview of Directory Services Using the
187 X.500 Protocol", by Weider, Reynolds, and Heker. This is available
188 from the NIC as FYI 14, RFC 1309. For a catalogue of X.500
189 implementations, see "A Catalog of Available X.500 Implementations",
190 ed. Lang and Wright. This is available from the NIC as FYI 11, RFC
193 5: SECURITY CONSIDERATIONS
195 Security issues are not discussed in this paper.
197 6: AUTHORS' ADDRESSES
200 Advanced Network and Services, Inc.
202 Ann Arbor, MI 48105-2437
205 E-mail: weider@ans.net
208 Information Sciences Institute
209 University of Southern California
211 Marina del Rey, CA 90292
213 Phone: (310) 822-1511
214 E-Mail: jkrey@isi.edu
226 DISI Working Group [Page 4]