HP UX Direry Server 5.3.3.1 Usage differences, 5.3.3.2 Evaluating access controls

The following sections describe some of the more specific differences between referrals and chaining in greater detail.

5.3.3.1 Usage differences

Some client applications do not support referrals. Chaining allows client applications to communicate with a single server and still access the data stored on many servers. Sometimes referrals do not work when a company's network uses proxies. For example, a client application may have permissions to communicate with only one server inside a firewall. If that application is referred to a different server, it is not able to contact it successfully.

A client must also be able to authenticate correctly when using referrals, which means that the servers to which clients are being referred need to contain the client's credentials. With chaining, client authentication takes place only once. Clients do not need to authenticate again on the servers to which their requests are chained.

5.3.3.2 Evaluating access controls

Chaining evaluates access controls differently from referrals. With referrals, an entry for the client must exist on all the target servers. With chaining, the client entry does not need to be on all the target servers.

Performing search requests using referrals The following diagram illustrates a client request to a server using referrals:

Figure 5-11 Sending a client request to a server using referrals

In the illustration above, the client application performs the following steps:

1.The client application first binds with Server A.

2.Server A contains an entry for the client that provides a user name and password, so it returns a bind acceptance message. In order for the referral to work, the client entry must be present on server A.

3.The client application sends the operation request to Server A.

4.However, Server A does not contain the requested information. Instead, Server A returns a referral to the client application instructing it to contact Server B.

5.The client application then sends a bind request to Server B. To bind successfully, Server B must also contain an entry for the client application.

6.The bind is successful, and the client application can now resubmit its search operation to Server B.

This approach requires Server B to have a replicated copy of the client's entry from Server A.

68 Designing the directory topology