Directory assistance

Computerworld - The Boeing Co. has a diverse directory infrastructure that includes products like Sun ONE, Microsoft Active Directory and Oracle. Having a heterogenous directory infrastructure in a company the size of Boeing is a practical necessity, but it also creates headaches for the aerospace company, which has 900 directory-enabled applications that serve some 150,000 employees.

The problem is that most identity management systems, Web portals and other directory-dependent applications are designed to access just one directory, but the data each requires may reside in many. Even when requested data is available in a single repository, it may not be structured in the way the application wants to see it.

As a result, getting each application to work with the directory infrastructure can become a big project, says Marty Schleiff, a cyberidentity specialist at the Boeing Shared Services Group.

"Every requirement means changing an existing directory without breaking it for existing clients or setting up a new directory," Schleiff says. A third option, customizing the application, can be costly. Unlike with internal application development projects, the money spent customizing a commercial application can't be leveraged by other applications, and customization adds to the amount of code that must be maintained, he says.

To solve the problem, Schleiff is turning to virtual directory software, an emerging class of products that he says offers a more flexible approach to providing applications with access to user account data and other attributes.

Boeing has piloted and is ready to begin a phased rollout of Virtual Directory Engine from OctetString Inc. in Schaumburg, Ill. To the application, the virtual directory looks just like the target directory it expects to see. It takes requests for data from the application, retrieves it from the back-end directories, performs any transformations needed and presents it to the application in the format required. No modification to the application or target directories is needed.

"We're deploying it to support many client applications. We're trying to create a shared service," Schleiff says.

The Virtual Difference

Virtual directories are similar to another tool: metadirectories. Both can access user data from different repositories. Metadirectories, a core element of user provisioning tools, copy data into a new repository that must be created, maintained and synchronized. The need to keep data updated can be a headache when data in source directories changes frequently. Some business units may also object to the idea of creating a second repository for customer data that will be outside of their control, citing regulatory or strategic concerns.

In contrast, virtual directories access the attributes requested from each directory or database on the fly. The software uses a cache to speed performance but typically doesn't store data locally.