* A single view of multiple forests
Remember when all of your directory objects were in one tree? But then people began developing separate trees for security reasons, which led to federated trees (i.e., trees that were related and could exchange some information). Microsoft coined the term “forest” for a related group of trees, which (naturally) lead to implementations of multiple forests. Where will it end? Will a grouping of related forests be called a “park”? Could there be related parks? It’s all Microsoft’s fault, (but then, what isn’t?).
Microsoft suggests multiple trees and multiple forests for any decent sized Active Directory implementation. In a “Professor Windows” article about best practices for Active Directory design and deployment (see editorial links below) Microsoft advises users to begin by determining the number of forests.
According to the article: “A single forest is the most simplistic and applicable implementation. It’s optimal from a functionality point of view. It’s efficient in terms of cost savings and resources. Yet, not every organization will find a single forest model to be sufficient. A forest shares a single Schema, Configuration, Global Catalog and complete trust between the domains inside the forest.”
The article goes on to point out the drawbacks of multiple forests: “There’s no automatic trust between forests. Kerberos is not available between forests in Windows 2000. Cross-forest transitive trusts do exist in Windows .Net Server though. Also, for the Global catalog to get forest scope aggregate a view across forests, a synchronization technology is required (e.g. MMS – Microsoft MetaDirectory Services).”
So security dictates multiple forests, but administration wants a single view – what’s a network executive to do?
My old friend Phil Hunt has a suggestion. Since he’s product manager at OctetString you can probably guess at least the source of the possible answer, and you’d be right. I’ve talked about OctetString’s VDE Virtual Directory Suite before (see: https://www.nwfusion.com/newsletters/dir/2001/01022496.html) – but there’s a new addition that Phil wanted me to look at and it’s a good way to solve the multiple forests problem – although it’s in no way limited to Active Directory installations.
The new module is VDE DB Proxy (Phil, who comes up with these names?) and it’s a Lightweight Directory Access Protocol (LDAP) proxy server. As well as doing typical LDAP Proxy stuff like load-balancing and fail-over management, the virtual directory technology allows customers to federate multiple directory sources (e.g., multiple Windows Active Directory forests) into a combined single directory view. This also enables applications (such as SAP HR Portal) to work against the combined corporate view. Why is this so special? According to Phil, It’s incredibly simple! There’s no duplication of application servers, no duplication of data, no synchronization, no provisioning, no extra per-entry license fees, and no politics! (Phil likes to use exclamation points when he talks).
It may not solve all of your political problems, but it could give you a better handle on administering applications and services while still protecting the overall security (and the parochial “job security”) of the enterprise. Take a look, it could be just what you need.
