ORY ACCESS PROTOCOL (LDAP) LDAP is a protocol that is used by many applications to retrieve information in a library in a standardized way. The information could deal with: Persons and enterprises Configuration of software and equipment Certificates for different security services Authorization rules Support for QoS including traffic priorities in the network. Directory enabled network- ing (DEN) uses for example LDAP to store attributes and traffic classes. The LDAP protocol is an IETF standard (RFC1779). LDAP exists in a number of ver- sions. LDAPv3 has an improved functionality for national characters and cross-references between different servers. Contrary to many other TCP-based protocols, like HTTP, FTP Security and Telnet, LDAP uses coded commands over the network. The transaction coding is called binary encoding rules (BER). An alternative directory service with less success is called Whois + E-mail programs get LDAP support to search e-mail addresses. LDAP is an important part of Windows 2000 Active Directory and Netware NDS (Netware Directory Services). All versions of web browsers have support for LDAP. LDAP is also a base for public key infrastructure (PKI). Almost all PKI systems use LDAP servers to search, verify and revoke certificates. The LDAP transfer must be safe, in particular when handling public keys. What if someone else pretends to be the LDAP directory? LDAP can be encapsulated in SSL or TLS. 6.8 INTEGRITY BY ACCESS CONTROL - AUTHORIZATION IN ENTERPRISES Data that is available in an internal company system must be protected. Only authorized staff must be able to access, read and change such data. Such security functions are built into most network operating systems. There are in principle two common ways to solve the problem: Users must log on with user identification and a password to get access to the network. In addition, different resources can be allocated to different users. The network is open to all, but when you want access to a specific resource you have to use a password which 