Netscape NETSCAPE DIRECTORY SERVER 6.01 - DEPLOYMENT Kurzanleitung

Deployment Guide

Netscape Directory Server

Version6.01

January 2002

Netscape Communications Corporation ("Netscape") and its licensors retain all ownership rights to the software programs offered by

Netscape (referred to herein as "Software") and related documentation. Use of the Software and related documentation is governed

by the license agreement for the Software and applicable copyright law.

Your right to copy this documentation is limited by copyright law. Making unauthorized copies, adaptations or compilation works is

prohibited and constitutes a punishable violation of the law. Netscape may revise this documentation from time to time without

notice.

THIS DOCUMENTATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN NO EVENT SHALL NETSCAPE BE

LIABLE FOR INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES OF ANY KIND ARISING FROM ANY

ERROR IN THIS DOCUMENTATION, INCLUDING WITHOUT LIMITATION ANY LOSS OR INTERRUPTION OF BUSINESS,

PROFITS, USE, OR DATA.

rights reserved.

Netscape and the Netscape N logo are registered trademarks of Netscape Communications Corporation in the United States and

other countries. Other Netscape logos, product names, and service names are also trademarks of Netscape Communications

Corporation, which may be registered in other countries. Other product and brand names are the exclusive property of their

respective owners.

The downloading, exporting, or reexporting of Netscape software or any underlying information or technology must be in full

compliance with all United States and other applicable laws and regulations. Any provision of Netscape software or documentation

to the U.S. government is with restricted rights as described in the license agreement for that Software.

Contents

AboutThisGuide ...............................................................9

PurposeofThisGuide ................................................................... 9

DirectoryServerOverview .............................................................. 10

ConventionsUsedinThisGuide ......................................................... 11

RelatedInformation .................................................................... 11

Chapter 1 IntroductiontoDirectoryServer........................................13

WhatisaDirectoryService? ............................................................. 13

AboutGlobalDirectoryServices....................................................... 14

AboutLDAP........................................................................ 15

IntroductiontoDirectoryServer ......................................................... 15

OverviewofDirectoryServerArchitecture.............................................. 17

OverviewoftheServerFront-End................................................... 17

ServerPlug-insOverview .......................................................... 17

OverviewoftheBasicDirectoryTree ................................................ 18

DirectoryServerDataStorage ......................................................... 19

AboutDirectoryEntries ........................................................... 20

DistributingDirectoryData ........................................................ 21

DirectoryDesignOverview.............................................................. 21

DesignProcessOutline............................................................... 22

DeployingYourDirectory ............................................................ 23

PilotingYourDirectory ............................................................ 23

PuttingYourDirectoryIntoProduction.............................................. 23

OtherGeneralDirectoryResources ....................................................... 24

Chapter 2 HowtoPlanYourDirectoryData .......................................25

IntroductiontoDirectoryData ........................................................... 25

4 Netscape Directory Server Deployment Guide • January 2002

WhatYourDirectoryMightInclude.................................................... 26

WhatYourDirectoryShouldNotInclude............................................... 27

DefiningYourDirectoryNeeds .......................................................... 27

PerformingaSiteSurvey ................................................................ 28

IdentifyingtheApplicationsthatUseYourDirectory..................................... 29

IdentifyingDataSources ............................................................. 30

CharacterizingYourDirectoryData.................................................... 31

DeterminingLevelofService.......................................................... 32

ConsideringaDataMaster............................................................ 32

DataMasteringforReplication ..................................................... 33

DataMasteringAcrossMultipleApplications ........................................ 33

DeterminingDataOwnership ......................................................... 34

DeterminingDataAccess ............................................................. 35

DocumentingYourSiteSurvey........................................................ 37

RepeatingtheSiteSurvey............................................................. 38

Chapter 3 HowtoDesigntheSchema ........................................... 39

SchemaDesignProcessOverview ........................................................ 39

NetscapeStandardSchema .............................................................. 40

SchemaFormat...................................................................... 40

StandardAttributes.................................................................. 42

StandardObjectClasses .............................................................. 43

MappingYourDatatotheDefaultSchema ................................................ 44

ViewingtheDefaultDirectorySchema ................................................. 44

MatchingDatatoSchemaElements .................................................... 45

CustomizingtheSchema ................................................................ 46

WhentoExtendYourSchema......................................................... 47

GettingandAssigningObjectIdentifiers................................................ 47

NamingAttributeandObjectClasses .................................................. 48

StrategiesforDefiningNewObjectClasses ............................................. 48

StrategiesforDefiningNewAttributes ................................................. 50

DeletingSchemaElements............................................................ 50

CreatingCustomSchemaFiles ........................................................ 51

CustomSchemaBestPractices ........................................................ 52

MaintainingConsistentSchema .......................................................... 53

SchemaChecking.................................................................... 54

SelectingConsistentDataFormats ..................................................... 54

MaintainingConsistencyinReplicatedSchema.......................................... 55

OtherSchemaResources ................................................................ 56

Chapter 4 Designing the Directory Tree . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57

IntroductiontotheDirectoryTree ........................................................ 57

DesigningYourDirectoryTree........................................................... 58

ChoosingaSuffix.................................................................... 58

SuffixNamingConventions ........................................................ 59

NamingMultipleSuffixes.......................................................... 60

CreatingYourDirectoryTreeStructure................................................. 60

BranchingYourDirectory.......................................................... 60

IdentifyingBranchPoints .......................................................... 62

ReplicationConsiderations......................................................... 64

AccessControlConsiderations ..................................................... 66

NamingEntries ..................................................................... 67

NamingPersonEntries ............................................................ 67

NamingGroupEntries ............................................................ 69

NamingOrganizationEntries ...................................................... 69

NamingOtherKindsofEntries ..................................................... 70

GroupingDirectoryEntries.............................................................. 70

AboutRoles ........................................................................ 71

DecidingBetweenRolesandGroups................................................... 72

AboutClassofService ............................................................... 72

DirectoryTreeDesignExamples ......................................................... 74

DirectoryTreeforanInternationalEnterprise ........................................... 74

DirectoryTreeforanISP ............................................................. 75

OtherDirectoryTreeResources .......................................................... 76

Chapter 5 Designing the Directory Topology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77

TopologyOverview .................................................................... 77

DistributingYourData.................................................................. 78

AboutUsingMultipleDatabases ...................................................... 79

AboutSuffixes ...................................................................... 80

AboutKnowledgeReferences............................................................ 82

UsingReferrals...................................................................... 82

TheStructureofanLDAPReferral .................................................. 83

AboutDefaultReferrals............................................................ 84

SmartReferrals ................................................................... 84

TipsforDesigningSmartReferrals .................................................. 87

UsingChaining ..................................................................... 88

DecidingBetweenReferralsandChaining .............................................. 89

UsageDifferences................................................................. 90

EvaluatingAccessControls ........................................................ 90

UsingIndexestoImproveDatabasePerformance........................................... 93

OverviewofDirectoryIndexTypes .................................................... 93

EvaluatingtheCostsofIndexing ...................................................... 94

6 Netscape Directory Server Deployment Guide • January 2002

Chapter 6 Designing the Replication Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95

IntroductiontoReplication .............................................................. 95

ReplicationConcepts................................................................. 96

UnitofReplication ................................................................ 97

Read-WriteReplica/Read-OnlyReplica.............................................. 97

Supplier/Consumer............................................................... 97

ChangeLog ...................................................................... 98

ReplicationAgreement ............................................................ 99

DataConsistency .................................................................... 99

CommonReplicationScenarios ......................................................... 100

Single-MasterReplication............................................................ 100

Multi-MasterReplication ............................................................ 101

CascadingReplication............................................................... 103

MixedEnvironments................................................................ 105

DefiningaReplicationStrategy ......................................................... 107

ReplicationSurvey.................................................................. 108

ReplicationResourceRequirements ................................................... 108

UsingReplicationforHighAvailability ............................................... 109

UsingReplicationforLocalAvailability ............................................... 110

UsingReplicationforLoadBalancing ................................................. 110

ExampleofNetworkLoadBalancing ............................................... 111

ExampleofLoadBalancingforImprovedPerformance ............................... 113

ExampleReplicationStrategyforaSmallSite .......................................... 114

ExampleReplicationStrategyforaLargeSite .......................................... 114

UsingReplicationwithotherDirectoryFeatures........................................... 115

ReplicationandAccessControl....................................................... 115

ReplicationandDirectoryServerPlug-ins ............................................. 115

ReplicationandDatabaseLinks ...................................................... 116

SchemaReplication ................................................................. 117

Chapter 7 Designing a Secure Directory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119

AboutSecurityThreats ................................................................ 119

UnauthorizedAccess ............................................................... 120

UnauthorizedTampering............................................................ 120

DenialofService ................................................................... 121

AnalyzingYourSecurityNeeds ......................................................... 121

DeterminingAccessRights .......................................................... 122

EnsuringDataPrivacyandIntegrity .................................................. 122

ConductingRegularAudits.......................................................... 123

ExampleSecurityNeedsAnalysis .................................................... 123

OverviewofSecurityMethods .......................................................... 124

SelectingAppropriateAuthenticationMethods ........................................... 124

AnonymousAccess ................................................................. 125

SimplePassword ................................................................... 126

Certificate-BasedAuthentication ..................................................... 127

SimplePasswordOverTLS .......................................................... 127

ProxyAuthentication ............................................................... 128

PreventingAuthenticationbyAccountInactivation........................................ 128

DesigningaPasswordPolicy ........................................................... 129

PasswordPolicyAttributes .......................................................... 129

PasswordChangeAfterReset ..................................................... 129

User-DefinedPasswords.......................................................... 130

PasswordExpiration ............................................................. 130

ExpirationWarning .............................................................. 131

PasswordSyntaxChecking........................................................ 131

PasswordLength ................................................................ 131

PasswordMinimumAge ......................................................... 132

PasswordHistory................................................................ 132

PasswordStorageScheme......................................................... 132

DesigningaPasswordPolicyinaReplicatedEnvironment............................... 133

DesigninganAccountLockoutPolicy ................................................. 133

DesigningAccessControl .............................................................. 134

AbouttheACIFormat .............................................................. 134

Targets ......................................................................... 135

Permissions ..................................................................... 136

BindRules ...................................................................... 137

SettingPermissions ................................................................. 138

ThePrecedenceRule ............................................................. 138

AllowingorDenyingAccess ...................................................... 138

WhentoDenyAccess ............................................................ 139

WheretoPlaceAccessControlRules ............................................... 139

UsingFilteredAccessControlRules ................................................ 140

UsingACIs:SomeHintsandTricks ................................................... 140

SecuringConnectionsWithSSL ......................................................... 142

OtherSecurityResources............................................................... 143

Chapter 8 DirectoryDesignExamples...........................................145

AnEnterprise......................................................................... 145

DataDesign ....................................................................... 146

SchemaDesign..................................................................... 146

DirectoryTreeDesign............................................................... 147

TopologyDesign ................................................................... 148

DatabaseTopology............................................................... 149

ServerTopology ................................................................. 149

ReplicationDesign.................................................................. 151

SupplierArchitecture............................................................. 151

8 Netscape Directory Server Deployment Guide • January 2002

SupplierConsumerArchitecture................................................... 152

SecurityDesign .................................................................... 153

TuningandOptimizations........................................................... 154

OperationsDecisions ............................................................... 154

AMultinationalEnterpriseanditsExtranet............................................... 154

DataDesign ....................................................................... 155

SchemaDesign..................................................................... 156

DirectoryTreeDesign............................................................... 156

TopologyDesign ................................................................... 159

DatabaseTopology............................................................... 159

ServerTopology ................................................................. 161

ReplicationDesign.................................................................. 163

SupplierArchitecture............................................................. 164

SecurityDesign .................................................................... 166

Glossary .................................................................... 167

Index ....................................................................... 183

About This Guide

Welcome to the Netscape Directory Server (Directory Server). This preface includes

the following sections:

• Purpose of This Guide (page 9)

• Directory Server Overview (page 10)

• Conventions Used in This Guide (page 11)

• Related Information (page 11)

Purpose of This Guide

This guide provides you with a foundation for planning your directory. The

information provided here is intended for directory decision makers, designers,

and administrators.

The first chapter of this guide introduces basic directory concepts. Most of the

remainder of the guide covers aspects of directory design, including schema

design, the directory tree, topology, replication, and security. The last chapter

provides sample deployment scenarios to help you plan simple deployments as

well as complex deployments designed to support millions of users distributed

worldwide.

Directory Server Overview

10 Netscape Directory Server Deployment Guide • January 2002

Directory Server Overview

Directory Server provides the following key features:

• Multi-master replication—Provides a highly available directory service for

both read and write operations. Multi-master replication can be combined with

simple and cascading replication scenarios to provide a highly flexible and

scalable replication environment.

• Chaining and referrals—Increases the power of your directory by storing a

complete logical view of your directory on a single server while maintaining

data on a large number of directory servers, transparently for clients.

• Roles and Class of Service—Provides a flexible mechanism for grouping and

sharing attributes between entries in a dynamic fashion.

• Improved access control mechanism—Provides support for macros that

dramatically reduce the number of access control statements used in the

directory, and increase the scalability of access control evaluation.

• Resource-limits by bind DN—Gives you the power to control the amount of

server resources allocated to search operations based on the bind DN of the

client.

• Multiple databases—Provides a simple way of breaking down your directory

data to simplify the implementation of replication and chaining in your

directory service.

• Password Policy and Account Lockout—Allows you to define a set of rules

that govern how passwords and user accounts are managed in the directory

server.

• SSL—Provides secure communications over the network including ciphers

with up to 168-bit encryption.

The major components of Directory Server include:

• An LDAP server—The core of the directory service, provided by the ns-slapd

daemon, and compliant with the LDAP v3 Internet standards.

• Directory Server Console—An improved management console that

dramatically reduces the effort of setting up and maintaining your directory

service. The directory console is part of Netscape Console, the common

management framework for Netscape servers.

• SNMP Agent—Permits you to monitor your directory server in real time using

the Simple Network Management Protocol (SNMP).

Dieses Handbuch passt für folgende Modelle

Inhaltsverzeichnis

Andere Netscape Server Handbücher

Netscape

Netscape NETSCAPE DIRECTORY SERVER 6.0 Bedienungsanleitung

Netscape

Netscape NETSCAPE DIRECTORY SERVER 6.02 Bedienungsanleitung

Netscape

Netscape NETSCAPE DIRECTORY SERVER 6.1 - PLUG-IN Bedienungsanleitung

Netscape

Netscape NETSCAPE DIRECTORY SERVER 7.0 Service-Handbuch

Netscape

Netscape NETSCAPE ENTERPRISE SERVER 6.1 - NSAPI PROGRAMMER... Bedienungsanleitung

Netscape

Netscape NETSCAPE DIRECTORY SERVER 6.2 - PLUG-IN Bedienungsanleitung

Netscape

Netscape NETSCAPE DIRECTORY SERVER 6.02 Service-Handbuch

Netscape

Netscape NETSCAPE DIRECTORY SERVER 6.01 Bedienungsanleitung

Netscape

Netscape NETSCAPE DIRECTORY SERVER 6.0 Bedienungsanleitung

Netscape

Netscape NETSCAPE DIRECTORY SERVER 6.0 - DEPLOYMENT Kurzanleitung

Netscape

Netscape NETSCAPE DIRECTORY SERVER 6.2 - GATEWAY... Bedienungsanleitung

Netscape

Netscape NETSCAPE DIRECTORY SERVER 6.1 - DEPLOYMENT Bedienungsanleitung

Netscape

Netscape NETSCAPE ENTERPRISE SERVER 6.0 - PROGRAMMER GUIDE TO... Handbuch

Netscape

Netscape NETSCAPE DIRECTORY SERVER 6.02 - PLUG-IN Bedienungsanleitung

Netscape

Netscape NETSCAPE ENTREPRISE SERVER 6.0 -... Service-Handbuch

Netscape

Netscape NETSCAPE DIRECTORY SERVER 7.0 Bedienungsanleitung

Netscape

Netscape NETSCAPE DIRECTORY SERVER 6.0 Service-Handbuch

Netscape

Netscape NETSCAPE ENTREPRISE SERVER 6.1 - INSTALLATION AND MIGRATION... Bedienungsanleitung

Netscape

Netscape NETSCAPE DIRECTORY SERVER 6.2 -... Service-Handbuch

Netscape

Netscape NETSCAPE DIRECTORY SERVER 7.0 - PLUG-IN Bedienungsanleitung

Netscape

Netscape NETSCAPE DIRECTORY SERVER 6.2 - GATEWAY... Service-Handbuch

Netscape

Netscape NETSCAPE DIRECTORY SERVER 6.01 Service-Handbuch

Netscape

Netscape NETSCAPE DIRECTORY SERVER 7.0 Bedienungsanleitung

Netscape

Netscape NETSCAPE ENTERPRISE SERVER 6.1 - PROGRAMMER GUIDE TO... Handbuch

Beliebte Server Handbücher anderer Marken

HP AlphaServer ES47 Bedienungsanleitung

Dell

Dell PowerEdge R410 Bedienungsanleitung

PowerNAS

PowerNAS CMA Bedienungsanleitung

Supero

Supero FatTwin F617R3-FT Bedienungsanleitung

MSI

MSI P1-109N-L70 Bedienungsanleitung

Dell

Dell PowerEdge XE9640 Handbuch

Dell

Dell PS4100 Montageanleitung

EtroVISION

EtroVISION EV3151 Bedienungsanleitung

NEC

NEC Express5800/T110j Bedienungsanleitung

HP ProLiant Gen9 Bedienungsanleitung

Compaq

Compaq ProLiant 3000 Handbuch

Dell

Dell PowerEdge 3YPMN Bedienungsanleitung

iRobo

iRobo IPC2U Bedienungsanleitung

Nortel

Nortel 1000 Con?guration guide Bedienungsanleitung

Asus

Asus AP7500 Bedienungs- und Wartungshandbuch

Avid Technology

Avid Technology AirSpeed 5000 Bedienungsanleitung

HP Integrity rx2600 Installationsanleitung

Milestone

Milestone Husky IVO 350T Bedienungsanleitung