Netscape NETSCAPE DIRECTORY SERVER 6.01 - DEPLOYMENT Guía de referencia rápida

Deployment Guide

Netscape Directory Server

Version6.01

January 2002

Netscape Communications Corporation ("Netscape") and its licensors retain all ownership rights to the software programs offered by

Netscape (referred to herein as "Software") and related documentation. Use of the Software and related documentation is governed

by the license agreement for the Software and applicable copyright law.

Your right to copy this documentation is limited by copyright law. Making unauthorized copies, adaptations or compilation works is

prohibited and constitutes a punishable violation of the law. Netscape may revise this documentation from time to time without

notice.

THIS DOCUMENTATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN NO EVENT SHALL NETSCAPE BE

LIABLE FOR INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES OF ANY KIND ARISING FROM ANY

ERROR IN THIS DOCUMENTATION, INCLUDING WITHOUT LIMITATION ANY LOSS OR INTERRUPTION OF BUSINESS,

PROFITS, USE, OR DATA.

rights reserved.

Netscape and the Netscape N logo are registered trademarks of Netscape Communications Corporation in the United States and

other countries. Other Netscape logos, product names, and service names are also trademarks of Netscape Communications

Corporation, which may be registered in other countries. Other product and brand names are the exclusive property of their

respective owners.

The downloading, exporting, or reexporting of Netscape software or any underlying information or technology must be in full

compliance with all United States and other applicable laws and regulations. Any provision of Netscape software or documentation

to the U.S. government is with restricted rights as described in the license agreement for that Software.

Contents

AboutThisGuide ...............................................................9

PurposeofThisGuide ................................................................... 9

DirectoryServerOverview .............................................................. 10

ConventionsUsedinThisGuide ......................................................... 11

RelatedInformation .................................................................... 11

Chapter 1 IntroductiontoDirectoryServer........................................13

WhatisaDirectoryService? ............................................................. 13

AboutGlobalDirectoryServices....................................................... 14

AboutLDAP........................................................................ 15

IntroductiontoDirectoryServer ......................................................... 15

OverviewofDirectoryServerArchitecture.............................................. 17

OverviewoftheServerFront-End................................................... 17

ServerPlug-insOverview .......................................................... 17

OverviewoftheBasicDirectoryTree ................................................ 18

DirectoryServerDataStorage ......................................................... 19

AboutDirectoryEntries ........................................................... 20

DistributingDirectoryData ........................................................ 21

DirectoryDesignOverview.............................................................. 21

DesignProcessOutline............................................................... 22

DeployingYourDirectory ............................................................ 23

PilotingYourDirectory ............................................................ 23

PuttingYourDirectoryIntoProduction.............................................. 23

OtherGeneralDirectoryResources ....................................................... 24

Chapter 2 HowtoPlanYourDirectoryData .......................................25

IntroductiontoDirectoryData ........................................................... 25

4 Netscape Directory Server Deployment Guide • January 2002

WhatYourDirectoryMightInclude.................................................... 26

WhatYourDirectoryShouldNotInclude............................................... 27

DefiningYourDirectoryNeeds .......................................................... 27

PerformingaSiteSurvey ................................................................ 28

IdentifyingtheApplicationsthatUseYourDirectory..................................... 29

IdentifyingDataSources ............................................................. 30

CharacterizingYourDirectoryData.................................................... 31

DeterminingLevelofService.......................................................... 32

ConsideringaDataMaster............................................................ 32

DataMasteringforReplication ..................................................... 33

DataMasteringAcrossMultipleApplications ........................................ 33

DeterminingDataOwnership ......................................................... 34

DeterminingDataAccess ............................................................. 35

DocumentingYourSiteSurvey........................................................ 37

RepeatingtheSiteSurvey............................................................. 38

Chapter 3 HowtoDesigntheSchema ........................................... 39

SchemaDesignProcessOverview ........................................................ 39

NetscapeStandardSchema .............................................................. 40

SchemaFormat...................................................................... 40

StandardAttributes.................................................................. 42

StandardObjectClasses .............................................................. 43

MappingYourDatatotheDefaultSchema ................................................ 44

ViewingtheDefaultDirectorySchema ................................................. 44

MatchingDatatoSchemaElements .................................................... 45

CustomizingtheSchema ................................................................ 46

WhentoExtendYourSchema......................................................... 47

GettingandAssigningObjectIdentifiers................................................ 47

NamingAttributeandObjectClasses .................................................. 48

StrategiesforDefiningNewObjectClasses ............................................. 48

StrategiesforDefiningNewAttributes ................................................. 50

DeletingSchemaElements............................................................ 50

CreatingCustomSchemaFiles ........................................................ 51

CustomSchemaBestPractices ........................................................ 52

MaintainingConsistentSchema .......................................................... 53

SchemaChecking.................................................................... 54

SelectingConsistentDataFormats ..................................................... 54

MaintainingConsistencyinReplicatedSchema.......................................... 55

OtherSchemaResources ................................................................ 56

Chapter 4 Designing the Directory Tree . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57

IntroductiontotheDirectoryTree ........................................................ 57

DesigningYourDirectoryTree........................................................... 58

ChoosingaSuffix.................................................................... 58

SuffixNamingConventions ........................................................ 59

NamingMultipleSuffixes.......................................................... 60

CreatingYourDirectoryTreeStructure................................................. 60

BranchingYourDirectory.......................................................... 60

IdentifyingBranchPoints .......................................................... 62

ReplicationConsiderations......................................................... 64

AccessControlConsiderations ..................................................... 66

NamingEntries ..................................................................... 67

NamingPersonEntries ............................................................ 67

NamingGroupEntries ............................................................ 69

NamingOrganizationEntries ...................................................... 69

NamingOtherKindsofEntries ..................................................... 70

GroupingDirectoryEntries.............................................................. 70

AboutRoles ........................................................................ 71

DecidingBetweenRolesandGroups................................................... 72

AboutClassofService ............................................................... 72

DirectoryTreeDesignExamples ......................................................... 74

DirectoryTreeforanInternationalEnterprise ........................................... 74

DirectoryTreeforanISP ............................................................. 75

OtherDirectoryTreeResources .......................................................... 76

Chapter 5 Designing the Directory Topology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77

TopologyOverview .................................................................... 77

DistributingYourData.................................................................. 78

AboutUsingMultipleDatabases ...................................................... 79

AboutSuffixes ...................................................................... 80

AboutKnowledgeReferences............................................................ 82

UsingReferrals...................................................................... 82

TheStructureofanLDAPReferral .................................................. 83

AboutDefaultReferrals............................................................ 84

SmartReferrals ................................................................... 84

TipsforDesigningSmartReferrals .................................................. 87

UsingChaining ..................................................................... 88

DecidingBetweenReferralsandChaining .............................................. 89

UsageDifferences................................................................. 90

EvaluatingAccessControls ........................................................ 90

UsingIndexestoImproveDatabasePerformance........................................... 93

OverviewofDirectoryIndexTypes .................................................... 93

EvaluatingtheCostsofIndexing ...................................................... 94

6 Netscape Directory Server Deployment Guide • January 2002

Chapter 6 Designing the Replication Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95

IntroductiontoReplication .............................................................. 95

ReplicationConcepts................................................................. 96

UnitofReplication ................................................................ 97

Read-WriteReplica/Read-OnlyReplica.............................................. 97

Supplier/Consumer............................................................... 97

ChangeLog ...................................................................... 98

ReplicationAgreement ............................................................ 99

DataConsistency .................................................................... 99

CommonReplicationScenarios ......................................................... 100

Single-MasterReplication............................................................ 100

Multi-MasterReplication ............................................................ 101

CascadingReplication............................................................... 103

MixedEnvironments................................................................ 105

DefiningaReplicationStrategy ......................................................... 107

ReplicationSurvey.................................................................. 108

ReplicationResourceRequirements ................................................... 108

UsingReplicationforHighAvailability ............................................... 109

UsingReplicationforLocalAvailability ............................................... 110

UsingReplicationforLoadBalancing ................................................. 110

ExampleofNetworkLoadBalancing ............................................... 111

ExampleofLoadBalancingforImprovedPerformance ............................... 113

ExampleReplicationStrategyforaSmallSite .......................................... 114

ExampleReplicationStrategyforaLargeSite .......................................... 114

UsingReplicationwithotherDirectoryFeatures........................................... 115

ReplicationandAccessControl....................................................... 115

ReplicationandDirectoryServerPlug-ins ............................................. 115

ReplicationandDatabaseLinks ...................................................... 116

SchemaReplication ................................................................. 117

Chapter 7 Designing a Secure Directory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119

AboutSecurityThreats ................................................................ 119

UnauthorizedAccess ............................................................... 120

UnauthorizedTampering............................................................ 120

DenialofService ................................................................... 121

AnalyzingYourSecurityNeeds ......................................................... 121

DeterminingAccessRights .......................................................... 122

EnsuringDataPrivacyandIntegrity .................................................. 122

ConductingRegularAudits.......................................................... 123

ExampleSecurityNeedsAnalysis .................................................... 123

OverviewofSecurityMethods .......................................................... 124

SelectingAppropriateAuthenticationMethods ........................................... 124

AnonymousAccess ................................................................. 125

SimplePassword ................................................................... 126

Certificate-BasedAuthentication ..................................................... 127

SimplePasswordOverTLS .......................................................... 127

ProxyAuthentication ............................................................... 128

PreventingAuthenticationbyAccountInactivation........................................ 128

DesigningaPasswordPolicy ........................................................... 129

PasswordPolicyAttributes .......................................................... 129

PasswordChangeAfterReset ..................................................... 129

User-DefinedPasswords.......................................................... 130

PasswordExpiration ............................................................. 130

ExpirationWarning .............................................................. 131

PasswordSyntaxChecking........................................................ 131

PasswordLength ................................................................ 131

PasswordMinimumAge ......................................................... 132

PasswordHistory................................................................ 132

PasswordStorageScheme......................................................... 132

DesigningaPasswordPolicyinaReplicatedEnvironment............................... 133

DesigninganAccountLockoutPolicy ................................................. 133

DesigningAccessControl .............................................................. 134

AbouttheACIFormat .............................................................. 134

Targets ......................................................................... 135

Permissions ..................................................................... 136

BindRules ...................................................................... 137

SettingPermissions ................................................................. 138

ThePrecedenceRule ............................................................. 138

AllowingorDenyingAccess ...................................................... 138

WhentoDenyAccess ............................................................ 139

WheretoPlaceAccessControlRules ............................................... 139

UsingFilteredAccessControlRules ................................................ 140

UsingACIs:SomeHintsandTricks ................................................... 140

SecuringConnectionsWithSSL ......................................................... 142

OtherSecurityResources............................................................... 143

Chapter 8 DirectoryDesignExamples...........................................145

AnEnterprise......................................................................... 145

DataDesign ....................................................................... 146

SchemaDesign..................................................................... 146

DirectoryTreeDesign............................................................... 147

TopologyDesign ................................................................... 148

DatabaseTopology............................................................... 149

ServerTopology ................................................................. 149

ReplicationDesign.................................................................. 151

SupplierArchitecture............................................................. 151

8 Netscape Directory Server Deployment Guide • January 2002

SupplierConsumerArchitecture................................................... 152

SecurityDesign .................................................................... 153

TuningandOptimizations........................................................... 154

OperationsDecisions ............................................................... 154

AMultinationalEnterpriseanditsExtranet............................................... 154

DataDesign ....................................................................... 155

SchemaDesign..................................................................... 156

DirectoryTreeDesign............................................................... 156

TopologyDesign ................................................................... 159

DatabaseTopology............................................................... 159

ServerTopology ................................................................. 161

ReplicationDesign.................................................................. 163

SupplierArchitecture............................................................. 164

SecurityDesign .................................................................... 166

Glossary .................................................................... 167

Index ....................................................................... 183

About This Guide

Welcome to the Netscape Directory Server (Directory Server). This preface includes

the following sections:

• Purpose of This Guide (page 9)

• Directory Server Overview (page 10)

• Conventions Used in This Guide (page 11)

• Related Information (page 11)

Purpose of This Guide

This guide provides you with a foundation for planning your directory. The

information provided here is intended for directory decision makers, designers,

and administrators.

The first chapter of this guide introduces basic directory concepts. Most of the

remainder of the guide covers aspects of directory design, including schema

design, the directory tree, topology, replication, and security. The last chapter

provides sample deployment scenarios to help you plan simple deployments as

well as complex deployments designed to support millions of users distributed

worldwide.

Directory Server Overview

10 Netscape Directory Server Deployment Guide • January 2002

Directory Server Overview

Directory Server provides the following key features:

• Multi-master replication—Provides a highly available directory service for

both read and write operations. Multi-master replication can be combined with

simple and cascading replication scenarios to provide a highly flexible and

scalable replication environment.

• Chaining and referrals—Increases the power of your directory by storing a

complete logical view of your directory on a single server while maintaining

data on a large number of directory servers, transparently for clients.

• Roles and Class of Service—Provides a flexible mechanism for grouping and

sharing attributes between entries in a dynamic fashion.

• Improved access control mechanism—Provides support for macros that

dramatically reduce the number of access control statements used in the

directory, and increase the scalability of access control evaluation.

• Resource-limits by bind DN—Gives you the power to control the amount of

server resources allocated to search operations based on the bind DN of the

client.

• Multiple databases—Provides a simple way of breaking down your directory

data to simplify the implementation of replication and chaining in your

directory service.

• Password Policy and Account Lockout—Allows you to define a set of rules

that govern how passwords and user accounts are managed in the directory

server.

• SSL—Provides secure communications over the network including ciphers

with up to 168-bit encryption.

The major components of Directory Server include:

• An LDAP server—The core of the directory service, provided by the ns-slapd

daemon, and compliant with the LDAP v3 Internet standards.

• Directory Server Console—An improved management console that

dramatically reduces the effort of setting up and maintaining your directory

service. The directory console is part of Netscape Console, the common

management framework for Netscape servers.

• SNMP Agent—Permits you to monitor your directory server in real time using

the Simple Network Management Protocol (SNMP).

Este manual sirve para los siguientes modelos

Tabla de contenidos

Otros manuales de Servidor de Netscape

Netscape

Netscape NETSCAPE DIRECTORY SERVER 6.01 - PLUG-IN Manual de usuario

Netscape

Netscape NETSCAPE DIRECTORY SERVER 6.02 Manual de usuario

Netscape

Netscape NETSCAPE ENTERPRISE SERVER 6.0 - NSAPI PROGRAMMER... Manual de usuario

Netscape

Netscape NETSCAPE DIRECTORY SERVER 6.2 -... Manual de servicio

Netscape

Netscape NETSCAPE DIRECTORY SERVER 6.2 - GATEWAY... Manual de servicio

Netscape

Netscape NETSCAPE DIRECTORY SERVER 6.01 Manual de servicio

Netscape

Netscape NETSCAPE ENTREPRISE SERVER 6.1 - 08-2002... Manual de servicio

Netscape

Netscape NETSCAPE DIRECTORY SERVER 6.1 - DEPLOYMENT Manual de servicio

Netscape

Netscape NETSCAPE ENTREPRISE SERVER 6.0 -... Manual de servicio

Netscape

Netscape NETSCAPE DIRECTORY SERVER 6.2 - GATEWAY... Manual de usuario

Netscape

Netscape NETSCAPE DIRECTORY SERVER 6.02 - PLUG-IN Manual de usuario

Netscape

Netscape NETSCAPE ENTERPRISE SERVER 6.0 - PROGRAMMER GUIDE TO... Manual

Netscape

Netscape NETSCAPE DIRECTORY SERVER 6.2 - PLUG-IN Manual de usuario

Netscape

Netscape NETSCAPE DIRECTORY SERVER 6.02 Manual de servicio

Netscape

Netscape NETSCAPE ENTREPRISE SERVER 6.1 - INSTALLATION AND MIGRATION... Manual de usuario

Netscape

Netscape NETSCAPE DIRECTORY SERVER 6.02 -... Manual de servicio

Netscape

Netscape NETSCAPE DIRECTORY SERVER 7.0 Manual de usuario

Netscape

Netscape NETSCAPE DIRECTORY SERVER 6.0 Manual de usuario

Netscape

Netscape NETSCAPE DIRECTORY SERVER 6.1 -... Manual de servicio

Netscape

Netscape NETSCAPE ENTERPRISE SERVER 6.1 - NSAPI PROGRAMMER... Manual de usuario

Netscape

Netscape NETSCAPE DIRECTORY SERVER 6.2 - DEPLOYMENT Guía de referencia rápida

Netscape

Netscape NETSCAPE DIRECTORY SERVER 6.1 - DEPLOYMENT Manual de usuario

Netscape

Netscape NETSCAPE ENTERPRISE SERVER 6.1 - PROGRAMMER GUIDE TO... Manual

Netscape

Netscape NETSCAPE DIRECTORY SERVER 6.1 - DEPLOYMENT Manual de usuario

Manuales populares de Servidor de otras marcas

HP AlphaServer ES47 Manual de usuario

Dell

Dell PowerEdge R410 Manual de usuario

PowerNAS

PowerNAS CMA Manual de usuario

Supero

Supero FatTwin F617R3-FT Manual de usuario

MSI

MSI P1-109N-L70 Manual de usuario

Dell

Dell PowerEdge XE9640 Manual

Dell

Dell PS4100 Instrucciones de montaje

EtroVISION

EtroVISION EV3151 Manual de usuario

NEC

NEC Express5800/T110j Manual de usuario

HP ProLiant Gen9 Manual de usuario

Compaq

Compaq ProLiant 3000 Manual

Dell

Dell PowerEdge 3YPMN Manual de usuario

iRobo

iRobo IPC2U Manual de usuario

Nortel

Nortel 1000 Con?guration guide Manual de usuario

Asus

Asus AP7500 Manual de operación y mantenimiento

Avid Technology

Avid Technology AirSpeed 5000 Manual de usuario

HP Integrity rx2600 Guía de instalación

Milestone

Milestone Husky IVO 350T Manual de usuario