Netscape NETSCAPE DIRECTORY SERVER 6.02 - DEPLOYMENT Quick reference guide

Deployment Guide

Netscape Directory Server

Version6.02

May 2002

Netscape Communications Corporation ("Netscape") and its licensors retain all ownership rights to the software programs offered by

Netscape (referred to herein as "Software") and related documentation. Use of the Software and related documentation is governed

by the license agreement for the Software and applicable copyright law.

Your right to copy this documentation is limited by copyright law. Making unauthorized copies, adaptations or compilation works is

prohibited and constitutes a punishable violation of the law. Netscape may revise this documentation from time to time without

notice.

THIS DOCUMENTATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN NO EVENT SHALL NETSCAPE BE

LIABLE FOR INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES OF ANY KIND ARISING FROM ANY

ERROR IN THIS DOCUMENTATION, INCLUDING WITHOUT LIMITATION ANY LOSS OR INTERRUPTION OF BUSINESS,

PROFITS, USE, OR DATA.

rights reserved.

Netscape and the Netscape N logo are registered trademarks of Netscape Communications Corporation in the United States and

other countries. Other Netscape logos, product names, and service names are also trademarks of Netscape Communications

Corporation, which may be registered in other countries. Other product and brand names are the exclusive property of their

respective owners.

The downloading, exporting, or reexporting of Netscape software or any underlying information or technology must be in full

compliance with all United States and other applicable laws and regulations. Any provision of Netscape software or documentation

to the U.S. government is with restricted rights as described in the license agreement for that Software.

Contents

AboutThisGuide ...............................................................9

PurposeofThisGuide ................................................................... 9

DirectoryServerOverview .............................................................. 10

ConventionsUsedinThisGuide ......................................................... 11

RelatedInformation .................................................................... 11

Chapter 1 IntroductiontoDirectoryServer........................................13

WhatisaDirectoryService? ............................................................. 13

AboutGlobalDirectoryServices....................................................... 14

AboutLDAP........................................................................ 15

IntroductiontoDirectoryServer ......................................................... 15

OverviewofDirectoryServerArchitecture.............................................. 17

OverviewoftheServerFront-End................................................... 17

ServerPlug-insOverview .......................................................... 17

OverviewoftheBasicDirectoryTree ................................................ 18

DirectoryServerDataStorage ......................................................... 19

AboutDirectoryEntries ........................................................... 20

DistributingDirectoryData ........................................................ 21

DirectoryDesignOverview.............................................................. 21

DesignProcessOutline............................................................... 22

DeployingYourDirectory ............................................................ 23

PilotingYourDirectory ............................................................ 23

PuttingYourDirectoryIntoProduction.............................................. 23

OtherGeneralDirectoryResources ....................................................... 24

Chapter 2 HowtoPlanYourDirectoryData .......................................25

IntroductiontoDirectoryData ........................................................... 25

4 Netscape Directory Server Deployment Guide • May 2002

WhatYourDirectoryMightInclude.................................................... 26

WhatYourDirectoryShouldNotInclude............................................... 27

DefiningYourDirectoryNeeds .......................................................... 27

PerformingaSiteSurvey ................................................................ 28

IdentifyingtheApplicationsthatUseYourDirectory..................................... 29

IdentifyingDataSources ............................................................. 30

CharacterizingYourDirectoryData.................................................... 31

DeterminingLevelofService.......................................................... 32

ConsideringaDataMaster............................................................ 32

DataMasteringforReplication ..................................................... 33

DataMasteringAcrossMultipleApplications ........................................ 33

DeterminingDataOwnership ......................................................... 34

DeterminingDataAccess ............................................................. 35

DocumentingYourSiteSurvey........................................................ 37

RepeatingtheSiteSurvey............................................................. 38

Chapter 3 HowtoDesigntheSchema ........................................... 39

SchemaDesignProcessOverview ........................................................ 39

NetscapeStandardSchema .............................................................. 40

SchemaFormat...................................................................... 40

StandardAttributes.................................................................. 42

StandardObjectClasses .............................................................. 43

MappingYourDatatotheDefaultSchema ................................................ 44

ViewingtheDefaultDirectorySchema ................................................. 44

MatchingDatatoSchemaElements .................................................... 45

CustomizingtheSchema ................................................................ 46

WhentoExtendYourSchema......................................................... 47

GettingandAssigningObjectIdentifiers................................................ 47

NamingAttributeandObjectClasses .................................................. 48

StrategiesforDefiningNewObjectClasses ............................................. 48

StrategiesforDefiningNewAttributes ................................................. 50

DeletingSchemaElements............................................................ 50

CreatingCustomSchemaFiles ........................................................ 51

CustomSchemaBestPractices ........................................................ 52

MaintainingConsistentSchema .......................................................... 53

SchemaChecking.................................................................... 54

SelectingConsistentDataFormats ..................................................... 54

MaintainingConsistencyinReplicatedSchema.......................................... 55

OtherSchemaResources ................................................................ 56

Chapter 4 Designing the Directory Tree . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57

IntroductiontotheDirectoryTree ........................................................ 57

DesigningYourDirectoryTree........................................................... 58

ChoosingaSuffix.................................................................... 58

SuffixNamingConventions ........................................................ 59

NamingMultipleSuffixes.......................................................... 60

CreatingYourDirectoryTreeStructure................................................. 60

BranchingYourDirectory.......................................................... 60

IdentifyingBranchPoints .......................................................... 62

ReplicationConsiderations......................................................... 64

AccessControlConsiderations ..................................................... 66

NamingEntries ..................................................................... 67

NamingPersonEntries ............................................................ 67

NamingGroupEntries ............................................................ 69

NamingOrganizationEntries ...................................................... 69

NamingOtherKindsofEntries ..................................................... 70

GroupingDirectoryEntries.............................................................. 70

AboutRoles ........................................................................ 71

DecidingBetweenRolesandGroups................................................... 72

AboutClassofService ............................................................... 72

DirectoryTreeDesignExamples ......................................................... 74

DirectoryTreeforanInternationalEnterprise ........................................... 74

DirectoryTreeforanISP ............................................................. 75

OtherDirectoryTreeResources .......................................................... 76

Chapter 5 Designing the Directory Topology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77

TopologyOverview .................................................................... 77

DistributingYourData.................................................................. 78

AboutUsingMultipleDatabases ...................................................... 79

AboutSuffixes ...................................................................... 80

AboutKnowledgeReferences............................................................ 82

UsingReferrals...................................................................... 82

TheStructureofanLDAPReferral .................................................. 83

AboutDefaultReferrals............................................................ 84

SmartReferrals ................................................................... 84

TipsforDesigningSmartReferrals .................................................. 87

UsingChaining ..................................................................... 88

DecidingBetweenReferralsandChaining .............................................. 89

UsageDifferences................................................................. 90

EvaluatingAccessControls ........................................................ 90

UsingIndexestoImproveDatabasePerformance........................................... 93

OverviewofDirectoryIndexTypes .................................................... 93

EvaluatingtheCostsofIndexing ...................................................... 94

6 Netscape Directory Server Deployment Guide • May 2002

Chapter 6 Designing the Replication Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95

IntroductiontoReplication .............................................................. 95

ReplicationConcepts................................................................. 96

UnitofReplication ................................................................ 97

Read-WriteReplica/Read-OnlyReplica.............................................. 97

Supplier/Consumer............................................................... 97

ChangeLog ...................................................................... 98

ReplicationAgreement ............................................................ 99

DataConsistency .................................................................... 99

CommonReplicationScenarios ......................................................... 100

Single-MasterReplication............................................................ 100

Multi-MasterReplication ............................................................ 101

CascadingReplication............................................................... 103

MixedEnvironments................................................................ 105

DefiningaReplicationStrategy ......................................................... 107

ReplicationSurvey.................................................................. 108

ReplicationResourceRequirements ................................................... 108

UsingReplicationforHighAvailability ............................................... 109

UsingReplicationforLocalAvailability ............................................... 110

UsingReplicationforLoadBalancing ................................................. 110

ExampleofNetworkLoadBalancing ............................................... 111

ExampleofLoadBalancingforImprovedPerformance ............................... 113

ExampleReplicationStrategyforaSmallSite .......................................... 114

ExampleReplicationStrategyforaLargeSite .......................................... 114

UsingReplicationwithotherDirectoryFeatures........................................... 115

ReplicationandAccessControl....................................................... 115

ReplicationandDirectoryServerPlug-ins ............................................. 115

ReplicationandDatabaseLinks ...................................................... 116

SchemaReplication ................................................................. 117

Chapter 7 Designing a Secure Directory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119

AboutSecurityThreats ................................................................ 119

UnauthorizedAccess ............................................................... 120

UnauthorizedTampering............................................................ 120

DenialofService ................................................................... 121

AnalyzingYourSecurityNeeds ......................................................... 121

DeterminingAccessRights .......................................................... 122

EnsuringDataPrivacyandIntegrity .................................................. 122

ConductingRegularAudits.......................................................... 123

ExampleSecurityNeedsAnalysis .................................................... 123

OverviewofSecurityMethods .......................................................... 124

SelectingAppropriateAuthenticationMethods ........................................... 124

AnonymousAccess ................................................................. 125

SimplePassword ................................................................... 126

Certificate-BasedAuthentication ..................................................... 127

SimplePasswordOverTLS .......................................................... 127

ProxyAuthentication ............................................................... 128

PreventingAuthenticationbyAccountInactivation........................................ 128

DesigningaPasswordPolicy ........................................................... 129

PasswordPolicyAttributes .......................................................... 129

PasswordChangeAfterReset ..................................................... 129

User-DefinedPasswords.......................................................... 130

PasswordExpiration ............................................................. 130

ExpirationWarning .............................................................. 131

PasswordSyntaxChecking........................................................ 131

PasswordLength ................................................................ 131

PasswordMinimumAge ......................................................... 132

PasswordHistory................................................................ 132

PasswordStorageScheme......................................................... 132

DesigningaPasswordPolicyinaReplicatedEnvironment............................... 133

DesigninganAccountLockoutPolicy ................................................. 133

DesigningAccessControl .............................................................. 134

AbouttheACIFormat .............................................................. 134

Targets ......................................................................... 135

Permissions ..................................................................... 136

BindRules ...................................................................... 137

SettingPermissions ................................................................. 138

ThePrecedenceRule ............................................................. 138

AllowingorDenyingAccess ...................................................... 138

WhentoDenyAccess ............................................................ 139

WheretoPlaceAccessControlRules ............................................... 139

UsingFilteredAccessControlRules ................................................ 140

UsingACIs:SomeHintsandTricks ................................................... 140

SecuringConnectionsWithSSL ......................................................... 142

OtherSecurityResources............................................................... 143

Chapter 8 DirectoryDesignExamples...........................................145

AnEnterprise......................................................................... 145

DataDesign ....................................................................... 146

SchemaDesign..................................................................... 146

DirectoryTreeDesign............................................................... 147

TopologyDesign ................................................................... 148

DatabaseTopology............................................................... 149

ServerTopology ................................................................. 149

ReplicationDesign.................................................................. 151

SupplierArchitecture............................................................. 151

8 Netscape Directory Server Deployment Guide • May 2002

SupplierConsumerArchitecture................................................... 152

SecurityDesign .................................................................... 153

TuningandOptimizations........................................................... 154

OperationsDecisions ............................................................... 154

AMultinationalEnterpriseanditsExtranet............................................... 154

DataDesign ....................................................................... 155

SchemaDesign..................................................................... 156

DirectoryTreeDesign............................................................... 156

TopologyDesign ................................................................... 158

DatabaseTopology............................................................... 158

ServerTopology ................................................................. 160

ReplicationDesign.................................................................. 162

SupplierArchitecture............................................................. 163

SecurityDesign .................................................................... 165

Glossary .................................................................... 167

Index ....................................................................... 183

About This Guide

Welcome to the Netscape Directory Server (Directory Server). This preface includes

the following sections:

• Purpose of This Guide (page 9)

• Directory Server Overview (page 10)

• Conventions Used in This Guide (page 11)

• Related Information (page 11)

Purpose of This Guide

This guide provides you with a foundation for planning your directory. The

information provided here is intended for directory decision makers, designers,

and administrators.

The first chapter of this guide introduces basic directory concepts. Most of the

remainder of the guide covers aspects of directory design, including schema

design, the directory tree, topology, replication, and security. The last chapter

provides sample deployment scenarios to help you plan simple deployments as

well as complex deployments designed to support millions of users distributed

worldwide.

Directory Server Overview

10 Netscape Directory Server Deployment Guide • May 2002

Directory Server Overview

Directory Server provides the following key features:

• Multi-master replication—Provides a highly available directory service for

both read and write operations. Multi-master replication can be combined with

simple and cascading replication scenarios to provide a highly flexible and

scalable replication environment.

• Chaining and referrals—Increases the power of your directory by storing a

complete logical view of your directory on a single server while maintaining

data on a large number of directory servers, transparently for clients.

• Roles and Class of Service—Provides a flexible mechanism for grouping and

sharing attributes between entries in a dynamic fashion.

• Improved access control mechanism—Provides support for macros that

dramatically reduce the number of access control statements used in the

directory, and increase the scalability of access control evaluation.

• Resource-limits by bind DN—Gives you the power to control the amount of

server resources allocated to search operations based on the bind DN of the

client.

• Multiple databases—Provides a simple way of breaking down your directory

data to simplify the implementation of replication and chaining in your

directory service.

• Password Policy and Account Lockout—Allows you to define a set of rules

that govern how passwords and user accounts are managed in the directory

server.

• SSL—Provides secure communications over the network including ciphers

with up to 168-bit encryption.

The major components of Directory Server include:

• An LDAP server—The core of the directory service, provided by the ns-slapd

daemon, and compliant with the LDAP v3 Internet standards.

• Directory Server Console—An improved management console that

dramatically reduces the effort of setting up and maintaining your directory

service. The directory console is part of Netscape Console, the common

management framework for Netscape servers.

• SNMP Agent—Permits you to monitor your directory server in real time using

the Simple Network Management Protocol (SNMP).

This manual suits for next models

Table of contents

Other Netscape Server manuals

Netscape

Netscape NETSCAPE DIRECTORY SERVER 6.0 - DEPLOYMENT Quick reference guide

Netscape

Netscape NETSCAPE DIRECTORY SERVER 6.01 User manual

Netscape

Netscape NETSCAPE DIRECTORY SERVER 6.1 - DEPLOYMENT User manual

Netscape

Netscape NETSCAPE DIRECTORY SERVER 6.2 - DEPLOYMENT Quick reference guide

Netscape

Netscape NETSCAPE DIRECTORY SERVER 6.2 -... Service manual

Netscape

Netscape NETSCAPE DIRECTORY SERVER 6.2 - GATEWAY... User manual

Netscape

Netscape NETSCAPE CONSOLE 6.0 - MANAGING SERVERS User manual

Netscape

Netscape NETSCAPE ENTREPRISE SERVER 6.0 - INSTALLATION AND MIGRATION... User manual

Netscape

Netscape NETSCAPE DIRECTORY SERVER 6.2 - GATEWAY... Service manual

Netscape

Netscape NETSCAPE DIRECTORY SERVER 7.0 User manual

Netscape

Netscape NETSCAPE DIRECTORY SERVER 6.02 User manual

Netscape

Netscape NETSCAPE DIRECTORY SERVER 6.0 Service manual

Netscape

Netscape NETSCAPE DIRECTORY SERVER 6.1 - PLUG-IN User manual

Netscape

Netscape NETSCAPE ENTREPRISE SERVER 6.1 - 04-2002... Service manual

Netscape

Netscape NETSCAPE DIRECTORY SERVER 6.01 User manual

Netscape

Netscape NETSCAPE DIRECTORY SERVER 6.0 User manual

Netscape

Netscape NETSCAPE DIRECTORY SERVER 6.01 - DEPLOYMENT Quick reference guide

Netscape

Netscape NETSCAPE DIRECTORY SERVER 6.1 - DEPLOYMENT Quick reference guide

Netscape

Netscape NETSCAPE ENTERPRISE SERVER 6.1 - PROGRAMMER GUIDE TO... Manual

Netscape

Netscape NETSCAPE DIRECTORY SERVER 6.2 - PLUG-IN User manual

Netscape

Netscape NETSCAPE DIRECTORY SERVER 6.02 - PLUG-IN User manual

Netscape

Netscape NETSCAPE DIRECTORY SERVER 7.0 - DEPLOYMENT Quick reference guide

Netscape

Netscape NETSCAPE ENTREPRISE SERVER 6.1 - INSTALLATION AND MIGRATION... User manual

Netscape

Netscape NETSCAPE ENTREPRISE SERVER 6.1 - 08-2002... Service manual

Popular Server manuals by other brands

HP AlphaServer ES47 Cli reference manual

Dell

Dell PowerEdge R410 Getting started

PowerNAS

PowerNAS CMA quick start guide

Supero

Supero FatTwin F617R3-FT user manual

MSI

MSI P1-109N-L70 user manual

Dell

Dell PowerEdge XE9640 Installation and service manual

Dell

Dell PS4100 Hardware

EtroVISION

EtroVISION EV3151 user manual

NEC

NEC Express5800/T110j System configuration guide

HP ProLiant Gen9 user guide

Compaq

Compaq ProLiant 3000 Maintenance and service guide

Dell

Dell PowerEdge 3YPMN Getting started guide

iRobo

iRobo IPC2U user manual

Nortel

Nortel 1000 Con?guration guide user manual

Asus

Asus AP7500 Hardware reference guide

Avid Technology

Avid Technology AirSpeed 5000 manual

HP Integrity rx2600 overview

Milestone

Milestone Husky IVO 350T Getting started