HP UX Direry Server manual Sasl

Page 152

S

 

SASL

An authentication framework for clients as they attempt to bind to a directory. Also Simple

 

Authentication and Security Layer .

schema

Definitions describing what types of information can be stored as entries in the directory. When

 

information that does not match the schema is stored in the directory, clients attempting to

 

access the directory may be unable to display the proper results.

schema checking

Ensures that entries added or modified in the directory conform to the defined schema. Schema

 

checking is on by default, and users will receive an error if they try to save an entry that does

 

not conform to the schema.

Secure Sockets

See SSL.

Layer

 

self access

When granted, indicates that users have access to their own entries if the bind DN matches the

 

targeted entry.

Server Console

Java-based application that allows you to perform administrative management of your Directory

 

Server from a GUI.

server daemon

The server daemon is a process that, once running, listens for and accepts requests from clients.

Server Selector

Interface that allows you select and configure servers using a browser.

server service

A process on Windows that, once running, listens for and accepts requests from clients. It is

 

the SMB server on Windows NT.

service

A background process on a Windows machine that is responsible for a particular system task.

 

Service processes do not need human intervention to continue functioning.

SIE

Server Instance Entry. The ID assigned to an instance of Directory Server during installation.

Simple

See SASL.

Authentication

 

and Security

 

Layer

 

Simple Network

See SNMP.

Management

 

Protocol

 

single-master

The most basic replication scenario in which multiple servers, up to four, each hold a copy of

replication

the same read-write replicas to replica servers. In a single-master replication scenario, the

 

supplier server maintains a changelog.

SIR

See supplier-initiated replication.

slapd

LDAP Directory Server daemon or service that is responsible for most functions of a directory

 

except replication.

 

See also ns-slapd.

SNMP

Used to monitor and manage application processes running on the servers by exchanging data

 

about network activity. Also Simple Network Management Protocol.

SNMP master

Software that exchanges information between the various subagents and the NMS.

agent

 

SNMP subagent

Software that gathers information about the managed device and passes the information to the

 

master agent. Also called a subagent.

SSL

A software library establishing a secure connection between two parties (client and server)

 

used to implement HTTPS, the secure version of HTTP. Also called Secure Sockets Layer.

standard index

index maintained by default.

sub suffix

A branch underneath a root suffix.

subagent

See SNMP subagent.

substring index

Allows for efficient searching against substrings within entries. Substring indexes are limited

 

to a minimum of two characters for each entry.

suffix

The name of the entry at the top of the directory tree, below which data is stored. Multiple

 

suffixes are possible within the same directory. Each database only has one suffix.

152 Glossary

Page 151 Page 153
Image 152
Page 151 Page 153
Contents HP-UX Directory Server deployment guide Page Table of Contents Designing the directory tree Designing the replication process 103 145 125141 155 About global directory services Introduction to directory servicesAbout directory services Overview of the server frontend Introduction to Directory ServerAbout Ldap Server plug-ins overview Overview of the basic directory treeDirectory Server data storage Expanded directory tree for example corpDirectory design overview About directory entriesDistributing directory data Performing queries on directory entriesDesign process outline Deploying the directoryOther general directory resources Page Planning the directory data Introduction to directory dataInformation to include in the directory Information to exclude from the directoryDefining directory needs Performing a site surveyIdentifying the applications that use the directory Identifying data sources Characterizing the directory dataDetermining level of service Considering a data masterDetermining data ownership Determining data access Example Tabulating data ownership and access Documenting the site surveyRepeating the site survey Page Designing the directory schema Schema design process overviewStandard schema Schema formatStandard attributes Standard object classes Syntaxes support in Directory ServerMatching data to schema elements Mapping the data to the default schemaViewing the default directory schema Customizing the schema Data mapped to default directory schemaWhen to extend the schema Getting and assigning object identifiersNaming attributes and object classes Strategies for defining new object classesNew object classes appear in LDAPv3 schema format as follows Strategies for defining new attributes Deleting schema elementsCreating custom schema files Custom schema best practices Naming schema filesMaintaining consistent schema Using user defined as the originDefining schema in a single file Defining attributes before object classesSelecting consistent data formats Schema checkingMaintaining consistency in replicated schema Other schema resources Designing the directory tree Introduction to the directory treeDesigning the directory tree Choosing a suffixSuffix naming conventions Naming multiple suffixesCreating the directory tree structure Branching the directoryIdentifying branch points Example environment directory treeDirectory tree for example isp Replication considerations Initial branching of the directory tree for example corpAccess control considerations Directory branching for example ispNaming Entries Naming person entriesNaming group entries Naming organization entriesNaming other kinds of entries Grouping directory entriesAbout roles About class of service Deciding between roles and groupsVirtual directory information tree views About virtual DIT views10 Examples of a flat and an organizationally-based DIT 11 a combined DIT using views Advantages of using virtual DIT views 12 a DIT with a virtual DIT view hierarchyExample of virtual DIT views Compatibility with existing applications Views and other directory featuresEffects of virtual views on performance Directory tree design examples Directory tree for an international enterpriseOther directory tree resources Directory tree for an ISPPage Distributing the directory data Designing the directory topologyTopology overview About using multiple databases Storing suffix data in separate databasesAbout suffixes Directory tree spread across multiple databasesUsing referrals About knowledge referencesAbout default referrals Structure of an Ldap referralUsing smart referrals to redirect requests Smart referralsRedirecting a query to a different server and namespace Tips for designing smart referrals 10 a circular referral patternUsing chaining Deciding between referrals and chainingEvaluating access controls Usage differencesThis illustration, the following steps are performed Using indexes to improve database performance Overview of directory index typesEvaluating the costs of indexing Page Designing the replication process Introduction to replicationReplication concepts Unit of replicationReplication and changelogs Read-write and read-only replicasSuppliers and consumers Replication agreement Common replication scenariosData consistency Single-master replication Multi-master replicationMulti-master replication configuration two suppliers Multi-master replication configuration B four suppliers Cascading replication Replication traffic in a multi-master environmentCascading replication scenario Mixed environments Replication traffic and changelogs in cascading replicationDefining a replication strategy Combined multi-master and cascading replicationConducting a replication survey Replicated selected attributes with fractional replicationReplication resource requirements Managing disk space required for multi-master replicationUsing replication for high availability Replication across a wide-area networkUsing replication for local availability Using replication for load balancingExample of network load balancing Effects of replication and remote lookup on the networkExample of load balancing for improved performance Calculating Directory Server loadExample replication strategy for a small site Example replication strategy for a large siteUsing replication with other Directory Server features Replication and access controlReplication and Directory Server plug-ins Replication and database linksSchema replication See Creating custom schema files for more informationReplication and synchronization Synchronization agreements Designing synchronizationWindows synchronization overview Planning windows synchronization ChangelogsControlling synchronization Resource requirementsManaging disk space for the changelog Defining the connection typeDetermining the subtree to synchronize Interaction with a replicated environmentIdentifying the directory data to synchronize Multi-master Directory Server Windows domain synchronizationEditing the sync agreement Synchronizing passwords and installing password servicesDefining an update strategy NtUserDomainId Password policies Values for cn attributesValues for street and streetAddress Contraints on the initials attributeNtGroupId Name Unauthorized access Designing a secure directoryAbout security threats Unauthorized tamperingAnalyzing security needs Denial of serviceDetermining access rights Overview of security methods Ensuring data privacy and integrityConducting regular audits Example security needs analysisSelecting appropriate authentication methods Anonymous accessSimple password Certificate-based authentication Simple password over SSL/TLSSimple authentication and security layer Proxy authenticationHow password policy works Preventing authentication by account deactivationDesigning a password policy Designing a secure directory Designing a password policy Password policy checking process User-defined passwords Password policy attributesPassword change after reset Password expiration Grace login limitPassword syntax checking Expiration warningPassword history Password lengthPassword minimum age Designing an account lockout policy Designing a password policy in a replicated environmentPassword storage schemes Designing access control About the ACI formatTargets PermissionsSetting permissions Allowing or denying accessBind rules Precedence ruleUsing filtered access control rules When to deny accessWhere to place access control rules Viewing ACIs Get effective rights Using ACIs Some hints and tricks Database encryption Use Ldap search filters cautiouslySecuring server to server connections Other security resourcesLocal enterprise schema design Directory design examplesDesign example a local enterprise Local enterprise data designLocal enterprise directory tree design Local enterprise topology design Database topologyLocal enterprise replication design Supplier architectureSupplier consumer architecture Supplier architecture for Example CorpLocal enterprise security design Supplier and consumer architecture for Example CorpLocal enterprise operations decisions Local enterprise tuning and optimizationsDesign example a multinational enterprise and its extranet Multinational enterprise directory tree design Multinational enterprise schema designMultinational enterprise data design Entry for the l=Asia entry appears in Ldif as follows Multinational enterprise topology design Directory tree for Example Corp. Internationals extranetServer topology 11 Server topology for Example Corp. Europe Multinational enterprise replication design 12 Server topology for Example Corp. Internationals extranet13 Supplier architecture for Example Corp. Europe Multinational enterprise security design Directory design examples Related information Support and other resourcesContacting HP HP-UX Directory Server administration server guide HP-UX documentation setTroubleshooting resources Typographic conventions144 Access rights GlossaryCGI DIT GSS-API Ldap NIS PTA Sasl TCP/IP 154 Index Index OID Sasl 159
Related manuals
Manual 96 pages 26.31 Kb Manual 68 pages 26.36 Kb Manual 18 pages 3.79 Kb Manual 72 pages 14.95 Kb

UX Direry Server specifications

HP UX Directory Server is a robust and scalable solution designed for managing directory information within enterprise networks. Developed by Hewlett-Packard (HP), this server offers an extensive set of features tailored to meet the needs of organizations that require an efficient way to store, manage, and retrieve identity and access data.

One of the key features of HP UX Directory Server is its ability to handle large directories with significant volumes of data. Built on a highly optimized architecture, it provides excellent performance and can support millions of entries without sacrificing speed or reliability. This capability makes it an ideal choice for large-scale deployments in enterprises that require high availability and responsiveness.

In addition to its scalability, HP UX Directory Server supports a wide range of protocols, including LDAP (Lightweight Directory Access Protocol), which ensures seamless integration with diverse applications and systems across various platforms. The server maintains standards compliance, which facilitates interoperability and simplifies administration tasks.

Security is a top priority for HP UX Directory Server, offering an array of features to protect sensitive information. It supports secure data transmission via TLS/SSL protocols, ensuring encrypted communication between clients and servers. Advanced access controls allow administrators to define fine-grained permissions, helping to safeguard directory data against unauthorized access.

Another salient feature of HP UX Directory Server is its replication capabilities. The server can replicate directory data across multiple instances, ensuring data consistency and availability in distributed environments. This feature is essential for businesses operating across different geographical locations or requiring failover solutions for disaster recovery.

HP UX Directory Server also comes equipped with tools for data management, including an intuitive administration console for configuring and monitoring the server. Additionally, it offers customizable schema capabilities, enabling organizations to tailor the directory structure to fit their specific needs.

Integration with existing identity management solutions is streamlined through connectors and APIs, allowing organizations to extend their directory services and enhance user experience.

In summary, HP UX Directory Server is a powerful directory management solution that combines scalability, security, and integration flexibility. Its support for industry standards, advanced replication, and comprehensive administrative tools makes it an essential asset for organizations seeking to manage identity and access efficiently. By leveraging this technology, businesses can improve their operational efficiency and ensure a secure and organized approach to directory management.
Top Page Image Contents