Netscape NETSCAPE DIRECTORY SERVER 6.1 - DEPLOYMENT Quick reference guide

Deployment Guide
Netscape Directory Server
Version6.1
August 2002

Netscape Communications Corporation ("Netscape") and its licensors retain all ownership rights to the software programs offered by
Netscape (referred to herein as "Software") and related documentation. Use of the Software and related documentation is governed
by the license agreement for the Software and applicable copyright law.
Your right to copy this documentation is limited by copyright law. Making unauthorized copies, adaptations or compilation works is
prohibited and constitutes a punishable violation of the law. Netscape may revise this documentation from time to time without
notice.
THIS DOCUMENTATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN NO EVENT SHALL NETSCAPE BE
LIABLE FOR INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES OF ANY KIND ARISING FROM ANY
ERROR IN THIS DOCUMENTATION, INCLUDING WITHOUT LIMITATION ANY LOSS OR INTERRUPTION OF BUSINESS,
PROFITS, USE, OR DATA.
The Software and documentation are copyright © 2001 Sun Microsystems, Inc. Portions copyright 1999, 2002 Netscape
Communications Corporation. All rights reserved.
Portions of the Software copyright © 1995 PEER Networks, Inc. All rights reserved. The Software contains the Taligent International
Classes from Taligent, Inc. and IBM Corp. Portions of the Software copyright ©1992-1998 Regents of the University of Michigan. All
rights reserved. The software contains encryption software from RSA Security Inc. Copyright © 1994 RSA Data Security, Inc. All
rights reserved.
Netscape and the Netscape N logo are registered trademarks of Netscape Communications Corporation in the United States and
other countries. Other Netscape logos, product names, and service names are also trademarks of Netscape Communications
Corporation, which may be registered in other countries. Other product and brand names are the exclusive property of their
respective owners.
The downloading, exporting, or reexporting of Netscape software or any underlying information or technology must be in full
compliance with all United States and other applicable laws and regulations. Any provision of Netscape software or documentation
to the U.S. government is with restricted rights as described in the license agreement for that Software.

3
Contents
AboutThisGuide ...............................................................9
PurposeofThisGuide ................................................................... 9
DirectoryServerOverview .............................................................. 10
ConventionsUsedinThisGuide ......................................................... 11
RelatedInformation .................................................................... 12
Chapter 1 IntroductiontoDirectoryServer........................................13
WhatisaDirectoryService? ............................................................. 13
AboutGlobalDirectoryServices....................................................... 14
AboutLDAP........................................................................ 15
IntroductiontoDirectoryServer ......................................................... 15
OverviewofDirectoryServerArchitecture.............................................. 16
OverviewoftheServerFront-End................................................... 17
ServerPlug-insOverview .......................................................... 17
OverviewoftheBasicDirectoryTree ................................................ 18
DirectoryServerDataStorage ......................................................... 19
AboutDirectoryEntries ........................................................... 20
DistributingDirectoryData ........................................................ 20
DirectoryDesignOverview.............................................................. 21
DesignProcessOutline............................................................... 21
DeployingYourDirectory ............................................................ 23
PilotingYourDirectory ............................................................ 23
PuttingYourDirectoryIntoProduction.............................................. 23
OtherGeneralDirectoryResources ....................................................... 23
Chapter 2 HowtoPlanYourDirectoryData .......................................25
IntroductiontoDirectoryData ........................................................... 25

4 Netscape Directory Server Deployment Guide • August 2002
WhatYourDirectoryMightInclude.................................................... 26
WhatYourDirectoryShouldNotInclude............................................... 27
DefiningYourDirectoryNeeds .......................................................... 27
PerformingaSiteSurvey ................................................................ 28
IdentifyingtheApplicationsthatUseYourDirectory..................................... 29
IdentifyingDataSources ............................................................. 30
CharacterizingYourDirectoryData.................................................... 31
DeterminingLevelofService.......................................................... 32
ConsideringaDataMaster............................................................ 32
DataMasteringforReplication ..................................................... 33
DataMasteringAcrossMultipleApplications ........................................ 33
DeterminingDataOwnership ......................................................... 34
DeterminingDataAccess ............................................................. 35
DocumentingYourSiteSurvey........................................................ 37
RepeatingtheSiteSurvey............................................................. 38
Chapter 3 HowtoDesigntheSchema ........................................... 39
SchemaDesignProcessOverview ........................................................ 39
NetscapeStandardSchema .............................................................. 40
SchemaFormat...................................................................... 40
StandardAttributes.................................................................. 42
StandardObjectClasses .............................................................. 43
MappingYourDatatotheDefaultSchema ................................................ 44
ViewingtheDefaultDirectorySchema ................................................. 44
MatchingDatatoSchemaElements .................................................... 45
CustomizingtheSchema ................................................................ 46
WhentoExtendYourSchema......................................................... 47
GettingandAssigningObjectIdentifiers................................................ 47
NamingAttributeandObjectClasses .................................................. 48
StrategiesforDefiningNewObjectClasses ............................................. 48
StrategiesforDefiningNewAttributes ................................................. 50
DeletingSchemaElements............................................................ 50
CreatingCustomSchemaFiles ........................................................ 51
CustomSchemaBestPractices ........................................................ 52
MaintainingConsistentSchema .......................................................... 53
SchemaChecking.................................................................... 54
SelectingConsistentDataFormats ..................................................... 54
MaintainingConsistencyinReplicatedSchema.......................................... 55
OtherSchemaResources ................................................................ 56
Chapter 4 Designing the Directory Tree . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
IntroductiontotheDirectoryTree ........................................................ 57

5
DesigningYourDirectoryTree........................................................... 58
ChoosingaSuffix.................................................................... 58
SuffixNamingConventions ........................................................ 59
NamingMultipleSuffixes.......................................................... 60
CreatingYourDirectoryTreeStructure................................................. 60
BranchingYourDirectory.......................................................... 61
IdentifyingBranchPoints .......................................................... 62
ReplicationConsiderations......................................................... 64
AccessControlConsiderations ..................................................... 66
NamingEntries ..................................................................... 67
NamingPersonEntries ............................................................ 68
NamingGroupEntries ............................................................ 69
NamingOrganizationEntries ...................................................... 70
NamingOtherKindsofEntries ..................................................... 70
GroupingDirectoryEntries.............................................................. 71
AboutRoles ........................................................................ 71
DecidingBetweenRolesandGroups................................................... 72
AboutClassofService ............................................................... 73
DirectoryTreeDesignExamples ......................................................... 74
DirectoryTreeforanInternationalEnterprise ........................................... 74
DirectoryTreeforanISP ............................................................. 75
VirtualDirectoryInformationTreeViews ................................................. 76
Overview........................................................................... 77
IntroductiontoVirtualDITViews ..................................................... 78
AdvantagesofUsingVirtualDITViews ................................................ 81
ExampleofVirtualDITViews......................................................... 82
ViewsandOtherDirectoryFeatures ................................................... 83
EffectsofVirtualViewsOnPerformance ............................................... 84
Compatibility With Existing Applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84
OtherDirectoryTreeResources .......................................................... 85
Chapter 5 Designing the Directory Topology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87
TopologyOverview .................................................................... 87
DistributingYourData.................................................................. 88
AboutUsingMultipleDatabases ...................................................... 89
AboutSuffixes ...................................................................... 90
AboutKnowledgeReferences............................................................ 92
UsingReferrals...................................................................... 92
TheStructureofanLDAPReferral .................................................. 93
AboutDefaultReferrals............................................................ 94
SmartReferrals ................................................................... 94
TipsforDesigningSmartReferrals .................................................. 97
UsingChaining ..................................................................... 98

6 Netscape Directory Server Deployment Guide • August 2002
DecidingBetweenReferralsandChaining .............................................. 99
UsageDifferences................................................................ 100
EvaluatingAccessControls ....................................................... 100
UsingIndexestoImproveDatabasePerformance.......................................... 103
OverviewofDirectoryIndexTypes ................................................... 103
EvaluatingtheCostsofIndexing ..................................................... 104
Chapter 6 Designing the Replication Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105
IntroductiontoReplication ............................................................. 105
ReplicationConcepts................................................................ 106
UnitofReplication ............................................................... 107
Read-WriteReplica/Read-OnlyReplica............................................. 107
Supplier/Consumer.............................................................. 107
ChangeLog ..................................................................... 108
ReplicationAgreement ........................................................... 109
DataConsistency ................................................................... 109
CommonReplicationScenarios ......................................................... 110
Single-MasterReplication............................................................ 110
Multi-MasterReplication ............................................................ 111
CascadingReplication............................................................... 113
MixedEnvironments................................................................ 115
DefiningaReplicationStrategy ......................................................... 117
ReplicationSurvey.................................................................. 118
ReplicationResourceRequirements ................................................... 118
UsingReplicationforHighAvailability ............................................... 119
UsingReplicationforLocalAvailability ............................................... 120
UsingReplicationforLoadBalancing ................................................. 120
ExampleofNetworkLoadBalancing ............................................... 121
ExampleofLoadBalancingforImprovedPerformance ............................... 123
ExampleReplicationStrategyforaSmallSite .......................................... 124
ExampleReplicationStrategyforaLargeSite .......................................... 124
UsingReplicationwithotherDirectoryFeatures........................................... 125
ReplicationandAccessControl....................................................... 125
ReplicationandDirectoryServerPlug-ins ............................................. 125
ReplicationandDatabaseLinks ...................................................... 126
SchemaReplication ................................................................. 127
Chapter 7 Designing a Secure Directory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129
AboutSecurityThreats ................................................................ 129
UnauthorizedAccess ............................................................... 130
UnauthorizedTampering............................................................ 130
DenialofService ................................................................... 131

7
AnalyzingYourSecurityNeeds ......................................................... 131
DeterminingAccessRights .......................................................... 132
EnsuringDataPrivacyandIntegrity .................................................. 132
ConductingRegularAudits.......................................................... 133
ExampleSecurityNeedsAnalysis .................................................... 133
OverviewofSecurityMethods .......................................................... 134
SelectingAppropriateAuthenticationMethods ........................................... 134
AnonymousAccess ................................................................. 135
SimplePassword ................................................................... 136
Certificate-BasedAuthentication ..................................................... 137
SimplePasswordOverTLS .......................................................... 137
ProxyAuthentication ............................................................... 138
PreventingAuthenticationbyAccountInactivation........................................ 138
DesigningaPasswordPolicy ........................................................... 139
PasswordPolicyAttributes .......................................................... 141
PasswordChangeAfterReset ..................................................... 142
User-DefinedPasswords.......................................................... 142
PasswordExpiration ............................................................. 143
ExpirationWarning .............................................................. 143
PasswordSyntaxChecking........................................................ 143
PasswordLength ................................................................ 144
PasswordMinimumAge ......................................................... 144
PasswordHistory................................................................ 144
PasswordStorageScheme......................................................... 144
DesigningaPasswordPolicyinaReplicatedEnvironment............................... 145
DesigninganAccountLockoutPolicy ................................................. 146
DesigningAccessControl .............................................................. 146
AbouttheACIFormat .............................................................. 147
Targets ......................................................................... 148
Permissions ..................................................................... 148
BindRules ...................................................................... 149
SettingPermissions ................................................................. 150
ThePrecedenceRule ............................................................. 150
AllowingorDenyingAccess ...................................................... 150
WhentoDenyAccess ............................................................ 151
WheretoPlaceAccessControlRules ............................................... 152
UsingFilteredAccessControlRules ................................................ 152
UsingACIs:SomeHintsandTricks ................................................... 153
SecuringConnectionsWithSSL ......................................................... 154
OtherSecurityResources............................................................... 155
Chapter 8 DirectoryDesignExamples...........................................157
AnEnterprise......................................................................... 157

8 Netscape Directory Server Deployment Guide • August 2002
DataDesign ....................................................................... 158
SchemaDesign..................................................................... 158
DirectoryTreeDesign............................................................... 159
TopologyDesign ................................................................... 160
DatabaseTopology............................................................... 161
ServerTopology ................................................................. 161
ReplicationDesign.................................................................. 163
SupplierArchitecture............................................................. 163
SupplierConsumerArchitecture................................................... 164
SecurityDesign .................................................................... 165
TuningandOptimizations........................................................... 166
OperationsDecisions ............................................................... 166
AMultinationalEnterpriseanditsExtranet............................................... 166
DataDesign ....................................................................... 167
SchemaDesign..................................................................... 168
DirectoryTreeDesign............................................................... 168
TopologyDesign ................................................................... 170
DatabaseTopology............................................................... 170
ServerTopology ................................................................. 172
ReplicationDesign.................................................................. 174
SupplierArchitecture............................................................. 175
SecurityDesign .................................................................... 177
Glossary .................................................................... 179
Index ....................................................................... 195

9
About This Guide
Welcome to the Netscape Directory Server (Directory Server). This preface includes
the following sections:
• Purpose of This Guide (page 9)
• Directory Server Overview (page 10)
• Conventions Used in This Guide (page 11)
• Related Information (page 12)
Purpose of This Guide
This guide provides you with a foundation for planning your directory. The
information provided here is intended for directory decision makers, designers,
and administrators.
The first chapter of this guide introduces basic directory concepts. Most of the
remainder of the guide covers aspects of directory design, including schema
design, the directory tree, topology, replication, and security. The last chapter
provides sample deployment scenarios to help you plan simple deployments as
well as complex deployments designed to support millions of users distributed
worldwide.

Directory Server Overview
10 Netscape Directory Server Deployment Guide • August 2002
Directory Server Overview
Directory Server provides the following key features:
• Multi-master replication—Provides a highly available directory service for
both read and write operations. Multi-master replication can be combined with
simple and cascading replication scenarios to provide a highly flexible and
scalable replication environment.
• Chaining and referrals—Increases the power of your directory by storing a
complete logical view of your directory on a single server while maintaining
data on a large number of directory servers, transparently for clients.
• Roles and Class of Service—Provides a flexible mechanism for grouping and
sharing attributes between entries in a dynamic fashion.
• Improved access control mechanism—Provides support for macros that
dramatically reduce the number of access control statements used in the
directory, and increase the scalability of access control evaluation.
• Resource-limits by bind DN—Gives you the power to control the amount of
server resources allocated to search operations based on the bind DN of the
client.
• Multiple databases—Provides a simple way of breaking down your directory
data to simplify the implementation of replication and chaining in your
directory service.
• Password Policy and Account Lockout—Allows you to define a set of rules
that govern how passwords and user accounts are managed in the directory
server.
• SSL—Provides secure communications over the network including ciphers
with up to 168-bit encryption.
The major components of Directory Server include:
• An LDAP server—The core of the directory service, provided by the ns-slapd
daemon, and compliant with the LDAP v3 Internet standards.
• Directory Server Console—An improved management console that
dramatically reduces the effort of setting up and maintaining your directory
service. The directory console is part of Netscape Console, the common
management framework for Netscape servers.
• SNMP Agent—Permits you to monitor your directory server in real time using
the Simple Network Management Protocol (SNMP).