.. SPDX-FileCopyrightText: 2024 Univention GmbH .. .. SPDX-License-Identifier: AGPL-3.0-only .. _component-directory-manager: Directory Manager ================= The *Directory Manager* is an abstraction layer for :ref:`data-objects-directory` in the *Identity Store and Directory Service*. It applies consistency checks and other business logic during the conversion of directory objects to UDM objects, an internal representation of data from the directory service. The main job of the *Directory Manager* is to provide the *UDM HTTP REST API* for create, read, update, and delete operations, so called :term:`CRUD` operations, to the :ref:`component-identity-provider-identity-store`. It's the only component in Nubus with write permissions to the directory service. The *UDM HTTP REST API* is available to Nubus components and third-party applications on the same cluster network. The Nubus :ref:`overview-components-portal-service`, :ref:`overview-components-provision-service`, :ref:`overview-components-authorization-service` and *Stack Data* are the consumers of the *UDM HTTP REST API*. *Stack Data* uses the :term:`CRUD` operations on UDM objects to load initial data into the directory service. The *Portal Service*, *Provisioning Service*, and *Authorization Service* functional components also use the *UDM HTTP REST API* and its CRUD operations to read and write UDM objects. .. _component-directory-manager-services-figure: .. figure:: /images/Functional_component_Directory_Manager_services.* :target: ../_images/Functional_component_Directory_Manager_services.svg :alt: Functional components relying on the Directory Manager Functional components relying on the *Directory Manager* :numref:`component-directory-manager-dependencies-figure` shows the dependencies for the *Directory Manager*. It depends only on the *Identity Store and Directory Service*. .. _component-directory-manager-dependencies-figure: .. figure:: /images/Functional_component_Directory_Manager_dependencies.* :target: ../_images/Functional_component_Directory_Manager_dependencies.svg :alt: Dependencies of the Directory Manager :width: 450px Dependencies of the *Directory Manager* .. seealso:: :ref:`interfaces-directory-manager` in interfaces and protocols section for information about incoming and outgoing interfaces. :ref:`deployment-directory-manager` in deployment view section for information about Docker images, Kubernetes pods, and Helm Charts used for deployment. :ref:`overview-components-directory-manager` in overviews section for information about purpose and tasks. :ref:`data-objects-directory` in data objects section for information about *Directory objects*. :ref:`data-objects-udm` in data objects section for information about *UDM objects*. .. _component-directory-manager-internals: Internal functions ------------------ The *Directory Manager* uses the following functions from the *UDM Library* to provide the *CRUD operations for UDM objects* service, as shown in :numref:`component-directory-manager-internals-figure`: * *Business logic for directory objects* * *Transform UDM objects to and from directory objects* The *UDM Library* is of central importance here. Its purpose is to provide the following functionality: Business logic for directory objects It's responsible for data integrity when writing to the *Identity Store and Directory Service*. It applies consistency checks and other business logic, and it guarantees stable values encoding and attribute names. For example, it creates multiple hashes for a user password and stores them in the directory object. The password hash for Kerberos uses a different hash function than for Keycloak. Transform UDM objects to and from directory objects It converts *UDM objects* to *Directory objects*, and the other way around. Many components in Nubus use *UDM objects*, because they rely on the business logic that the Directory Manager applies when transforming objects. .. _component-directory-manager-internals-figure: .. figure:: /images/Functional_component_Directory_Manager_internals.* :target: ../_images/Functional_component_Directory_Manager_internals.svg :alt: Functional component directory manager internals Internal components of the *Directory Manager* .. _component-directory-manager-api-authentication: Authentication and authorization for CRUD operations ---------------------------------------------------- When a user signs in to Nubus, they must authenticate themselves. The same principle applies to the *Directory Manger*, as well. :numref:`component-directory-manager-api-authentication-figure` shows that the *Directory Manager* uses access control list based authentication through LDAP to determine what the actor using the directory manager can do in the directory service. .. _component-directory-manager-api-authentication-figure: .. figure:: /images/Functional_component_Directory_Manager_API_authentication.* :target: ../_images/Functional_component_Directory_Manager_API_authentication.svg :alt: Functional component directory manager api authentication :width: 700px The *Directory Manager* uses authentication and authorization through ACLs .. seealso:: Wikipedia: `Access-control list `_ for more information about ACLs and content of ACLs. .. _component-directory-manager-startup-nubus: Populate data on initial startup of Nubus ----------------------------------------- When Nubus for Kubernetes starts up for the first time, the *Identity Store and Directory Service* populates initial data to the directory service using the *UDM HTTP REST API*. :numref:`component-directory-manager-startup-nubus-figure` shows the data flow. *Nubus initial startup* is the event that triggers *Load initial data for directory service*. The initial data is a representation of UDM objects. The *Stack Data* component is the owner of the initial data. It populates the following initial content through the *UDM HTTP REST API*: * Default users * Default policies * Default portal tiles The *UDM HTTP REST API* uses *LDAP* for the write operations. .. _component-directory-manager-startup-nubus-figure: .. figure:: /images/Functional_component_Directory_Manager_startup_Nubus.* :target: ../_images/Functional_component_Directory_Manager_startup_Nubus.svg :alt: Populate initial content into the *Identity Store and Directory Service* upon first Nubus startup Populate initial content into the *Identity Store and Directory Service* upon first Nubus startup