Netscape NETSCAPE DIRECTORY SERVER 6.0 - DEPLOYMENT Quick reference guide

Deployment Guide
Netscape Directory Server
Version6.0
December 2001

Netscape Communications Corporation ("Netscape") and its licensors retain all ownership rights to the software programs offered by
Netscape (referred to herein as "Software") and related documentation. Use of the Software and related documentation is governed
by the license agreement for the Software and applicable copyright law.
Your right to copy this documentation is limited by copyright law. Making unauthorized copies, adaptations or compilation works is
prohibited and constitutes a punishable violation of the law. Netscape may revise this documentation from time to time without
notice.
THIS DOCUMENTATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN NO EVENT SHALL NETSCAPE BE
LIABLE FOR INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES OF ANY KIND ARISING FROM ANY
ERROR IN THIS DOCUMENTATION, INCLUDING WITHOUT LIMITATION ANY LOSS OR INTERRUPTION OF BUSINESS,
PROFITS, USE, OR DATA.
The Software and documentation are copyright © 2001 Sun Microsystems, Inc. Portions copyright 1999, 2001 Netscape
Communications Corporation. All rights reserved.
Portions of the Software copyright © 1995 PEER Networks, Inc. All rights reserved. The Software contains the Taligent International
Classes from Taligent, Inc. and IBM Corp. Portions of the Software copyright ©1992-1998 Regents of the University of Michigan. All
rights reserved. The software contains encryption software from RSA Security Inc. Copyright © 1994 RSA Data Security, Inc. All
rights reserved.
Netscape and the Netscape N logo are registered trademarks of Netscape Communications Corporation in the United States and
other countries. Other Netscape logos, product names, and service names are also trademarks of Netscape Communications
Corporation, which may be registered in other countries. Other product and brand names are the exclusive property of their
respective owners.
The downloading, exporting, or reexporting of Netscape software or any underlying information or technology must be in full
compliance with all United States and other applicable laws and regulations. Any provision of Netscape software or documentation
to the U.S. government is with restricted rights as described in the license agreement for that Software.

3
Contents
AboutThisGuide ...............................................................9
PurposeofThisGuide ................................................................... 9
DirectoryServerOverview .............................................................. 10
ConventionsUsedinThisGuide ......................................................... 11
RelatedInformation .................................................................... 11
Chapter 1 IntroductiontoDirectoryServer........................................13
WhatisaDirectoryService? ............................................................. 13
AboutGlobalDirectoryServices....................................................... 14
AboutLDAP........................................................................ 15
IntroductiontoDirectoryServer ......................................................... 15
OverviewofDirectoryServerArchitecture.............................................. 17
OverviewoftheServerFront-End................................................... 17
ServerPlug-insOverview .......................................................... 17
OverviewoftheBasicDirectoryTree ................................................ 18
DirectoryServerDataStorage ......................................................... 19
AboutDirectoryEntries ........................................................... 20
DistributingDirectoryData ........................................................ 21
DirectoryDesignOverview.............................................................. 21
DesignProcessOutline............................................................... 22
DeployingYourDirectory ............................................................ 23
PilotingYourDirectory ............................................................ 23
PuttingYourDirectoryIntoProduction.............................................. 23
OtherGeneralDirectoryResources ....................................................... 24
Chapter 2 HowtoPlanYourDirectoryData .......................................25
IntroductiontoDirectoryData ........................................................... 25

4 Netscape Directory Server Deployment Guide • December 2001
WhatYourDirectoryMightInclude.................................................... 26
WhatYourDirectoryShouldNotInclude............................................... 27
DefiningYourDirectoryNeeds .......................................................... 27
PerformingaSiteSurvey ................................................................ 28
IdentifyingtheApplicationsthatUseYourDirectory..................................... 29
IdentifyingDataSources ............................................................. 30
CharacterizingYourDirectoryData.................................................... 31
DeterminingLevelofService.......................................................... 32
ConsideringaDataMaster............................................................ 32
DataMasteringforReplication ..................................................... 33
DataMasteringAcrossMultipleApplications ........................................ 33
DeterminingDataOwnership ......................................................... 34
DeterminingDataAccess ............................................................. 35
DocumentingYourSiteSurvey........................................................ 37
RepeatingtheSiteSurvey............................................................. 38
Chapter 3 HowtoDesigntheSchema ........................................... 39
SchemaDesignProcessOverview ........................................................ 39
NetscapeStandardSchema .............................................................. 40
SchemaFormat...................................................................... 40
StandardAttributes.................................................................. 42
StandardObjectClasses .............................................................. 43
MappingYourDatatotheDefaultSchema ................................................ 44
ViewingtheDefaultDirectorySchema ................................................. 44
MatchingDatatoSchemaElements .................................................... 45
CustomizingtheSchema ................................................................ 46
WhentoExtendYourSchema......................................................... 47
GettingandAssigningObjectIdentifiers................................................ 47
NamingAttributeandObjectClasses .................................................. 48
StrategiesforDefiningNewObjectClasses ............................................. 48
StrategiesforDefiningNewAttributes ................................................. 50
DeletingSchemaElements............................................................ 50
CreatingCustomSchemaFiles ........................................................ 51
CustomSchemaBestPractices ........................................................ 52
MaintainingConsistentSchema .......................................................... 53
SchemaChecking.................................................................... 54
SelectingConsistentDataFormats ..................................................... 54
MaintainingConsistencyinReplicatedSchema.......................................... 55
OtherSchemaResources ................................................................ 56
Chapter 4 Designing the Directory Tree . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
IntroductiontotheDirectoryTree ........................................................ 57

5
DesigningYourDirectoryTree........................................................... 58
ChoosingaSuffix.................................................................... 58
SuffixNamingConventions ........................................................ 59
NamingMultipleSuffixes.......................................................... 60
CreatingYourDirectoryTreeStructure................................................. 60
BranchingYourDirectory.......................................................... 60
IdentifyingBranchPoints .......................................................... 62
ReplicationConsiderations......................................................... 64
AccessControlConsiderations ..................................................... 66
NamingEntries ..................................................................... 67
NamingPersonEntries ............................................................ 67
NamingGroupEntries ............................................................ 69
NamingOrganizationEntries ...................................................... 69
NamingOtherKindsofEntries ..................................................... 70
GroupingDirectoryEntries.............................................................. 70
AboutRoles ........................................................................ 71
DecidingBetweenRolesandGroups................................................... 72
AboutClassofService ............................................................... 72
DirectoryTreeDesignExamples ......................................................... 74
DirectoryTreeforanInternationalEnterprise ........................................... 74
DirectoryTreeforanISP ............................................................. 75
OtherDirectoryTreeResources .......................................................... 76
Chapter 5 Designing the Directory Topology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
TopologyOverview .................................................................... 77
DistributingYourData.................................................................. 78
AboutUsingMultipleDatabases ...................................................... 79
AboutSuffixes ...................................................................... 80
AboutKnowledgeReferences............................................................ 82
UsingReferrals...................................................................... 82
TheStructureofanLDAPReferral .................................................. 83
AboutDefaultReferrals............................................................ 84
SmartReferrals ................................................................... 84
TipsforDesigningSmartReferrals .................................................. 87
UsingChaining ..................................................................... 88
DecidingBetweenReferralsandChaining .............................................. 89
UsageDifferences................................................................. 90
EvaluatingAccessControls ........................................................ 90
UsingIndexestoImproveDatabasePerformance........................................... 93
OverviewofDirectoryIndexTypes .................................................... 93
EvaluatingtheCostsofIndexing ...................................................... 94

6 Netscape Directory Server Deployment Guide • December 2001
Chapter 6 Designing the Replication Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95
IntroductiontoReplication .............................................................. 95
ReplicationConcepts................................................................. 96
UnitofReplication ................................................................ 97
Read-WriteReplica/Read-OnlyReplica.............................................. 97
Supplier/Consumer............................................................... 97
ChangeLog ...................................................................... 98
ReplicationAgreement ............................................................ 99
DataConsistency .................................................................... 99
CommonReplicationScenarios ......................................................... 100
Single-MasterReplication............................................................ 100
Multi-MasterReplication ............................................................ 101
CascadingReplication............................................................... 103
MixedEnvironments................................................................ 105
DefiningaReplicationStrategy ......................................................... 107
ReplicationSurvey.................................................................. 108
ReplicationResourceRequirements ................................................... 108
UsingReplicationforHighAvailability ............................................... 109
UsingReplicationforLocalAvailability ............................................... 110
UsingReplicationforLoadBalancing ................................................. 110
ExampleofNetworkLoadBalancing ............................................... 111
ExampleofLoadBalancingforImprovedPerformance ............................... 113
ExampleReplicationStrategyforaSmallSite .......................................... 114
ExampleReplicationStrategyforaLargeSite .......................................... 114
UsingReplicationwithotherDirectoryFeatures........................................... 115
ReplicationandAccessControl....................................................... 115
ReplicationandDirectoryServerPlug-ins ............................................. 115
ReplicationandDatabaseLinks ...................................................... 116
SchemaReplication ................................................................. 117
Chapter 7 Designing a Secure Directory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119
AboutSecurityThreats ................................................................ 119
UnauthorizedAccess ............................................................... 120
UnauthorizedTampering............................................................ 120
DenialofService ................................................................... 121
AnalyzingYourSecurityNeeds ......................................................... 121
DeterminingAccessRights .......................................................... 122
EnsuringDataPrivacyandIntegrity .................................................. 122
ConductingRegularAudits.......................................................... 123
ExampleSecurityNeedsAnalysis .................................................... 123
OverviewofSecurityMethods .......................................................... 124
SelectingAppropriateAuthenticationMethods ........................................... 124
AnonymousAccess ................................................................. 125

7
SimplePassword ................................................................... 126
Certificate-BasedAuthentication ..................................................... 127
SimplePasswordOverTLS .......................................................... 127
ProxyAuthentication ............................................................... 128
PreventingAuthenticationbyAccountInactivation........................................ 128
DesigningaPasswordPolicy ........................................................... 129
PasswordPolicyAttributes .......................................................... 129
PasswordChangeAfterReset ..................................................... 129
User-DefinedPasswords.......................................................... 130
PasswordExpiration ............................................................. 130
ExpirationWarning .............................................................. 131
PasswordSyntaxChecking........................................................ 131
PasswordLength ................................................................ 131
PasswordMinimumAge ......................................................... 132
PasswordHistory................................................................ 132
PasswordStorageScheme......................................................... 132
DesigningaPasswordPolicyinaReplicatedEnvironment............................... 133
DesigninganAccountLockoutPolicy ................................................. 133
DesigningAccessControl .............................................................. 134
AbouttheACIFormat .............................................................. 134
Targets ......................................................................... 135
Permissions ..................................................................... 136
BindRules ...................................................................... 137
SettingPermissions ................................................................. 138
ThePrecedenceRule ............................................................. 138
AllowingorDenyingAccess ...................................................... 138
WhentoDenyAccess ............................................................ 139
WheretoPlaceAccessControlRules ............................................... 139
UsingFilteredAccessControlRules ................................................ 140
UsingACIs:SomeHintsandTricks ................................................... 140
SecuringConnectionsWithSSL ......................................................... 142
OtherSecurityResources............................................................... 143
Chapter 8 DirectoryDesignExamples...........................................145
AnEnterprise......................................................................... 145
DataDesign ....................................................................... 146
SchemaDesign..................................................................... 146
DirectoryTreeDesign............................................................... 147
TopologyDesign ................................................................... 148
DatabaseTopology............................................................... 149
ServerTopology ................................................................. 149
ReplicationDesign.................................................................. 151
SupplierArchitecture............................................................. 151

8 Netscape Directory Server Deployment Guide • December 2001
SupplierConsumerArchitecture................................................... 152
SecurityDesign .................................................................... 153
TuningandOptimizations........................................................... 154
OperationsDecisions ............................................................... 154
AMultinationalEnterpriseanditsExtranet............................................... 154
DataDesign ....................................................................... 155
SchemaDesign..................................................................... 156
DirectoryTreeDesign............................................................... 156
TopologyDesign ................................................................... 159
DatabaseTopology............................................................... 159
ServerTopology ................................................................. 161
ReplicationDesign.................................................................. 163
SupplierArchitecture............................................................. 164
SecurityDesign .................................................................... 166
Glossary .................................................................... 167
Index ....................................................................... 183

9
About This Guide
Welcome to the Netscape Directory Server (Directory Server). This preface includes
the following sections:
• Purpose of This Guide (page 9)
• Directory Server Overview (page 10)
• Conventions Used in This Guide (page 11)
• Related Information (page 11)
Purpose of This Guide
This guide provides you with a foundation for planning your directory. The
information provided here is intended for directory decision makers, designers,
and administrators.
The first chapter of this guide introduces basic directory concepts. Most of the
remainder of the guide covers aspects of directory design, including schema
design, the directory tree, topology, replication, and security. The last chapter
provides sample deployment scenarios to help you plan simple deployments as
well as complex deployments designed to support millions of users distributed
worldwide.

Directory Server Overview
10 Netscape Directory Server Deployment Guide • December 2001
Directory Server Overview
Directory Server provides the following key features:
• Multi-master replication—Provides a highly available directory service for
both read and write operations. Multi-master replication can be combined with
simple and cascading replication scenarios to provide a highly flexible and
scalable replication environment.
• Chaining and referrals—Increases the power of your directory by storing a
complete logical view of your directory on a single server while maintaining
data on a large number of directory servers, transparently for clients.
• Roles and Class of Service—Provides a flexible mechanism for grouping and
sharing attributes between entries in a dynamic fashion.
• Improved access control mechanism—Provides support for macros that
dramatically reduce the number of access control statements used in the
directory, and increase the scalability of access control evaluation.
• Resource-limits by bind DN—Gives you the power to control the amount of
server resources allocated to search operations based on the bind DN of the
client.
• Multiple databases—Provides a simple way of breaking down your directory
data to simplify the implementation of replication and chaining in your
directory service.
• Password Policy and Account Lockout—Allows you to define a set of rules
that govern how passwords and user accounts are managed in the directory
server.
• SSL—Provides secure communications over the network including ciphers
with up to 168-bit encryption.
The major components of Directory Server include:
• An LDAP server—The core of the directory service, provided by the ns-slapd
daemon, and compliant with the LDAP v3 Internet standards.
• Directory Server Console—An improved management console that
dramatically reduces the effort of setting up and maintaining your directory
service. The directory console is part of Netscape Console, the common
management framework for Netscape servers.
• SNMP Agent—Permits you to monitor your directory server in real time using
the Simple Network Management Protocol (SNMP).

Conventions Used in This Guide
About This Guide 11
• Online backup and restore—Allows you to create backups and restore from
backups while the server is running.
Conventions Used in This Guide
This guide uses the following conventions:
Monospaced font—Thistypefaceisusedforanytextthatappearsonthecomputer
screen or text that you should type. It is also used for filenames, functions, and
examples.
Throughout this guide you will see path references of the following form:
/usr/netscape/servers/slapd-serverID/...
The /usr/netscape/servers directory is the default installation directory. If you
have installed the Directory Server in a different location, you should adapt the
path accordingly. The serverID variable represents the server identifier you gave
the server when you installed it. For example, if you gave the server an identifier of
phonebook, then the actual path would be:
/export/ns-home/slapd-phonebook/. . .
All paths specified in this manual are in UNIX format. If you are using a Windows
NT version of Directory Server, use equivalent paths.
Related Information
The document set for Directory Server also contains the following guides:
•Netscape Directory Server Installation Guide. Contains procedures for installing
your Directory Server as well as procedures for migrating your Directory
Server.
•Netscape Directory Server Administrator’s Guide. Contains procedures for the
day-to-day maintenance of your directory service. Includes information on
configuring server-side plug-ins.
NOTE Notes, Cautions and Tips mark important information. Make sure
you read this information before continuing.

Related Information
12 Netscape Directory Server Deployment Guide • December 2001
•Netscape Directory Server Configuration, Command, and File Reference. Provides
information about using the command-line scripts shipped with Directory
Server.
•Netscape Directory Server Schema Reference. Provides reference information
about the Netscape Directory Server schema.
For a list of documentation installed with Directory Server, open the
<server_root>/manual/en/slapd/index.htm file, where <server_root> is the
directory in which you installed Directory Server.
For the latest information about Directory Server, including current release notes,
complete product documentation, technical notes, and deployment information,
checkthissite:http://enterprise.netscape.com/docs

13
Chapter 1
Introduction to Directory Server
Netscape Directory Server (Directory Server) provides a centralized directory
service for your intranet, network, and extranet information. Directory Server
integrates with existing systems and acts as a centralized repository for the
consolidation of employee, customer, supplier, and partner information. You can
extend Directory Server to manage user profiles and preferences, as well as
extranet user authentication.
This chapter describes the basic ideas you need to understand before designing
your directory. It includes the following sections:
• What is a Directory Service? (page 13)
• Introduction to Directory Server (page 15)
• Directory Design Overview (page 21)
• Other General Directory Resources (page 24)
What is a Directory Service?
The term directory service means the collection of software, hardware, and
processes that store information about your enterprise, subscribers, or both and
make that information available to users. A directory service consists of at least one
instance of Directory Server and one or more directory client programs. Client
programs can access names, phone numbers, addresses, and other data stored in
the directory.
One common directory service is a Domain Name System (DNS) server. A DNS
server maps a computer host name to an IP address. Thus, all of the computing
resources (hosts) become clients of the DNS server. The mapping of host names
allows users of your computing resources to easily locate computers on your
network by remembering host names rather than numerical IP addresses.

What is a Directory Service?
14 Netscape Directory Server Deployment Guide • December 2001
However, the DNS server stores only two types of information: names and IP
addresses. A true directory service stores virtually unlimited types of information.
Directory Server stores all of your information in a single, network-accessible
repository. The following are a few examples of the kinds of information you might
store in a directory:
• Physical device information, such as data about the printers in your
organization (where they reside, whether they are color or black and white,
their manufacturer, date of purchase, and serial number)
• Public employee information, such as name, email address, and department
• Private employee information, such as salary, government identification
numbers, home addresses, phone numbers, and pay grade
• Contract or account information, such as the name of a client, final delivery
date, bidding information, contract numbers, and project dates
Directory Server serves the needs of a wide variety of applications. It also provides
a standard protocol and application programming interfaces (APIs) to access the
information it contains.
The following sections describe global directory services and the Lightweight Data
Access Protocol (LDAP).
About Global Directory Services
Directory Server provides global directory services, meaning it provides
information to a wide variety of applications. Until recently, many applications
came bundled with their own proprietary databases. While a proprietary database
can be convenient if you use only one application, multiple databases become an
administrative burden if the databases manage the same information.
For example, suppose your network supports three different proprietary email
systems, each system with its own proprietary directory service. If users change
their passwords in one directory, the changes are not automatically replicated in
the others. Managing multiple instances of the same information results in
increased hardware and personnel costs, a problem referred to as the n + 1
directory problem.

Introduction to Directory Server
Chapter 1 Introduction to Directory Server 15
A global directory service solves the n+1 directory problem by providing a single,
centralized repository of directory information that any application can access.
However, giving a wide variety of applications access to the directory requires a
network-based means of communicating between the applications and the
directory. Directory Server uses LDAP (Lightweight Directory Access Protocol) to
give applications access to its global directory service.
About LDAP
LDAP provides a common language that client applications and servers use to
communicate with one another. LDAP is a “lightweight” version of the Directory
Access Protocol (DAP) used by the ISO X.500 standard. DAP gives any application
access to the directory via an extensible and robust information framework, but at
an expensive administrative cost. DAP uses a communications layer that is not the
Internet standard TCP/IP protocol and has complicated directory-naming
conventions.
LDAP preserves the best features of DAP while reducing administrative costs.
LDAP uses an open directory access protocol running over TCP/IP and uses
simplified encoding methods. It retains the X.500 standard data model and can
support millions of entries for a modest investment in hardware and network
infrastructure.
Introduction to Directory Server
Directory Server includes the directory itself, the server-side software that
implements the LDAP protocol, and a graphical user interface that allows
end-users to search and change entries in the directory. Other LDAP clients are
also available, including the directory managers in the Netscape Console and the
Address Book feature in Netscape Communicator 4.x. In addition, you can
purchase other LDAP client programs or write your own using the LDAP client
SDK included with the Directory Server product.
Without adding other LDAP client programs, Directory Server can provide the
foundation for your intranet or extranet. Every Netscape server uses the directory
as a central repository for shared server information, such as employee, customer,
supplier, and partner data.

Introduction to Directory Server
16 Netscape Directory Server Deployment Guide • December 2001
You can use Directory Server to manage extranet user-authentication, create access
control, set up user preferences, and centralize user management. In hosted
environments, partners, customers, and suppliers can manage their own portions
of the directory, reducing administrative costs.
When you install Directory Server, the following components are installed on your
machine:
• An LDAP server (Directory Server) with a plug-in interface
The name of this process is ns-slapd.
• Netscape Administration Server
For more information about the Administration Server, see Managing Servers
with Netscape Console.
• Netscape Console to manage the servers
For more information about the Netscape Console, see Managing Servers with
Netscape Console.
• Directory Server Gateway (DSGW), a simple HTTP server for displaying user
information
Thenameofthisprocessisdsgw. For more information about Directory Server
Gateway, see Netscape Directory Server Gateway Customization Guide.
• Command-line tools for starting and stopping the server, importing and
exporting data in the database, database reindexing, account inactivation and
deactivation, LDIF merges, and kernel tuning
For more information about the command-line tools, refer to Netscape Directory
Server Configuration, Command, and File Reference.
•AnSNMPmonitor
For more information about SNMP monitoring, refer to the Netscape Directory
Server Administrator’s Guide.
This guide talks about the core Directory Server and the plug-ins it uses for doing
its work. The next sections describe Directory Server in more detail. The topics
discussed are:
• “Overview of Directory Server Architecture,” on page 17
• “Directory Server Data Storage,” on page 19

Introduction to Directory Server
Chapter 1 Introduction to Directory Server 17
Overview of Directory Server Architecture
At installation, Directory Server contains the following:
• A server front-end responsible for network communications
• Plug-ins for server functions, such as access control and replication
• A basic directory tree containing server-related data.
The following sections describe each component of the directory in more detail.
Overview of the Server Front-End
The server front-end of Directory Server manages communications with directory
client programs. Directory Server functions as a daemon on UNIX systems and as a
service on Windows NT and Windows 2000. Multiple client programs can speak to
the server in LDAP. They can communicate using LDAP over TCP/IP. The
connection can also be protected with SSL/TLS, depending on whether the client
negotiates the use of Transport Layer Security (TLS) for the connection.
When communication takes place with TLS, the communication is usually
encrypted. In the future, when DNS security is present, TLS used in conjunction
with secured DNS will provide confirmation to client applications that they are
binding to the correct server. If clients have been issued certificates, TLS can be
used by Directory Server to confirm that the client has the right to access the server.
TLS and its predecessor SSL are used throughout Netscape server products to
perform other security activities such as message integrity checks, digital
signatures, and mutual authentication between servers.
Multiple clients can bind to the server at the same time over the same network
because the Directory Server is a multi-threaded application. As directory services
grow to include larger numbers of entries or larger numbers of clients spread out
geographically, they also include multiple Directory Servers placed in strategic
places around the network.
Server Plug-ins Overview
Directory Server relies on plug-ins. A plug-in is a way to add functionality to the
core server. For example, a database is a plug-in.
A plug-in can be disabled. When disabled, the plug-in’s configuration information
remains in the directory but its function will not be used by the server. Depending
upon the what you want your directory to do, you can choose to enable any of the
plug-ins provided with Directory Server.

Introduction to Directory Server
18 Netscape Directory Server Deployment Guide • December 2001
Netscape Professional Services can write custom plug-ins for your Directory Server
deployment. Contact Netscape Professional Services for more information.
Overview of the Basic Directory Tree
The directory tree, also known as a directory information tree or DIT, mirrors the
tree model used by most file systems, with the tree’s root, or first entry, appearing
at the top of the hierarchy. At installation, Directory Server creates a default
directory tree.
The default directory tree appears as follows:
The root of the tree is called the root suffix. For information about naming the root
suffix, refer to “Choosing a Suffix,” on page 58.
At installation, the directory contains up to four subtrees under your root suffix:
•cn=config
This subtree contains information about the server’s internal configuration.
•o=NetscapeRoot
This subtree contains the configuration information of other Netscape servers,
such as Administration Server. The Administration Server takes care of
authentication and all actions that cannot be performed through LDAP (such
as starting or stopping).
•o=userRoot
During installation, a user database is created by default. Its default name is
o=userRoot. You can choose to populate it at installation time, or populate
later.

Introduction to Directory Server
Chapter 1 Introduction to Directory Server 19
You can build on the default directory tree to add any data relevant to your
directory installation. An example of a directory tree for example.com Corporation
follows:
For more information about directory trees, refer to Chapter 4, “Designing the
Directory Tree.”
Directory Server Data Storage
Your directory data is stored in an LDBM database. The LDBM database is
implemented as a plug-in that is automatically installed with the directory and is
enabled by default.
The database is the basic unit of storage, performance, replication, and indexing.
You can do operations like importing, exporting, backing up, restoring, and
indexing on the database.
NOTE When you install another instance of Directory Server, you can
specify that it does not contain the o=NetscapeRoot information,
that it uses the configuration directory (or the o=NetscapeRoot
subtree) present on another server. See the Netscape Directory Server
Installation Guide for more information about deciding upon the
location of your configuration directory.

Introduction to Directory Server
20 Netscape Directory Server Deployment Guide • December 2001
By default, Directory Server uses a single database to contain the directory tree.
This database can manage millions of entries. The default database supports
advanced methods of backing up and restoring your data, so that your data is not
at risk.
You can choose to use multiple databases to support your Directory Server. You
can distribute your data across the databases, allowing the server to hold more
data than can be stored in a single database.
The following sections describe how a directory database stores data.
About Directory Entries
LDIF is a standard text-based format for describing directory entries. An entry is a
group of lines in the LDIF file that contains information about an object, such as a
person in your organization or a printer on your network. Information about the
entry is represented in the LDIF file by a set of attributes and their values. Each
entry has an object class attribute that specifies the kind of object the entry
describes and defines the set of additional attributes it contains. Each attribute
describes a particular trait of an entry.
For example, an entry might be of an object class organizationalPerson,
indicating that the entry represents a person within a particular organization. This
object class allows the givenname and telephoneNumber attributes. The values
assigned to these attributes give the name and phone number of the person
represented by the entry.
Directory Server also uses read-only attributes that are calculated by the server.
These attributes are called operational attributes. There are also some operational
attributes that can be set by the administrator, for access control and other server
functions.
Entries are stored in a hierarchical structure in the directory tree. In LDAP, you can
query an entry and request all entries below it in the directory tree. This subtree is
calledthebasedistinguishedname,orbaseDN.Forexample,ifyoumakean
LDAP search request specifying a base DN of ou=people, dc=example,dc=com,
then the search operation examines only the ou=people subtree in the
dc=example,dc=com directory tree.
However, all entries are not automatically returned in response to an LDAP search.
This is because Directory Server 5.0 introduces a new kind of entry, entries of the
object class ldapsubentry.Anldapsubentry entry represents an administrative
object, for example entries used to define a role or a class of service are of the
ldapsubentry type. Entries of type ldapsubentry are not returned in response to
normal search requests. To receive these entries, clients need to search specifically
for entries of the ldapsubentry object class.