Netscape NETSCAPE DIRECTORY SERVER 6.1 - DEPLOYMENT Quick reference guide

Deployment Guide
Netscape Directory Server
Version6.1
August 2002

Netscape Communications Corporation ("Netscape") and its licensors retain all ownership rights to the software programs offered by
Netscape (referred to herein as "Software") and related documentation. Use of the Software and related documentation is governed
by the license agreement for the Software and applicable copyright law.
Your right to copy this documentation is limited by copyright law. Making unauthorized copies, adaptations or compilation works is
prohibited and constitutes a punishable violation of the law. Netscape may revise this documentation from time to time without
notice.
THIS DOCUMENTATION IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. IN NO EVENT SHALL NETSCAPE BE
LIABLE FOR INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES OF ANY KIND ARISING FROM ANY
ERROR IN THIS DOCUMENTATION, INCLUDING WITHOUT LIMITATION ANY LOSS OR INTERRUPTION OF BUSINESS,
PROFITS, USE, OR DATA.
The Software and documentation are copyright © 2001 Sun Microsystems, Inc. Portions copyright 1999, 2002 Netscape
Communications Corporation. All rights reserved.
Portions of the Software copyright © 1995 PEER Networks, Inc. All rights reserved. The Software contains the Taligent International
Classes from Taligent, Inc. and IBM Corp. Portions of the Software copyright ©1992-1998 Regents of the University of Michigan. All
rights reserved. The software contains encryption software from RSA Security Inc. Copyright © 1994 RSA Data Security, Inc. All
rights reserved.
Netscape and the Netscape N logo are registered trademarks of Netscape Communications Corporation in the United States and
other countries. Other Netscape logos, product names, and service names are also trademarks of Netscape Communications
Corporation, which may be registered in other countries. Other product and brand names are the exclusive property of their
respective owners.
The downloading, exporting, or reexporting of Netscape software or any underlying information or technology must be in full
compliance with all United States and other applicable laws and regulations. Any provision of Netscape software or documentation
to the U.S. government is with restricted rights as described in the license agreement for that Software.

3
Contents
AboutThisGuide ...............................................................9
PurposeofThisGuide ................................................................... 9
DirectoryServerOverview .............................................................. 10
ConventionsUsedinThisGuide ......................................................... 11
RelatedInformation .................................................................... 12
Chapter 1 IntroductiontoDirectoryServer........................................13
WhatisaDirectoryService? ............................................................. 13
AboutGlobalDirectoryServices....................................................... 14
AboutLDAP........................................................................ 15
IntroductiontoDirectoryServer ......................................................... 15
OverviewofDirectoryServerArchitecture.............................................. 16
OverviewoftheServerFront-End................................................... 17
ServerPlug-insOverview .......................................................... 17
OverviewoftheBasicDirectoryTree ................................................ 18
DirectoryServerDataStorage ......................................................... 19
AboutDirectoryEntries ........................................................... 20
DistributingDirectoryData ........................................................ 20
DirectoryDesignOverview.............................................................. 21
DesignProcessOutline............................................................... 21
DeployingYourDirectory ............................................................ 23
PilotingYourDirectory ............................................................ 23
PuttingYourDirectoryIntoProduction.............................................. 23
OtherGeneralDirectoryResources ....................................................... 23
Chapter 2 HowtoPlanYourDirectoryData .......................................25
IntroductiontoDirectoryData ........................................................... 25

4 Netscape Directory Server Deployment Guide • August 2002
WhatYourDirectoryMightInclude.................................................... 26
WhatYourDirectoryShouldNotInclude............................................... 27
DefiningYourDirectoryNeeds .......................................................... 27
PerformingaSiteSurvey ................................................................ 28
IdentifyingtheApplicationsthatUseYourDirectory..................................... 29
IdentifyingDataSources ............................................................. 30
CharacterizingYourDirectoryData.................................................... 31
DeterminingLevelofService.......................................................... 32
ConsideringaDataMaster............................................................ 32
DataMasteringforReplication ..................................................... 33
DataMasteringAcrossMultipleApplications ........................................ 33
DeterminingDataOwnership ......................................................... 34
DeterminingDataAccess ............................................................. 35
DocumentingYourSiteSurvey........................................................ 37
RepeatingtheSiteSurvey............................................................. 38
Chapter 3 HowtoDesigntheSchema ........................................... 39
SchemaDesignProcessOverview ........................................................ 39
NetscapeStandardSchema .............................................................. 40
SchemaFormat...................................................................... 40
StandardAttributes.................................................................. 42
StandardObjectClasses .............................................................. 43
MappingYourDatatotheDefaultSchema ................................................ 44
ViewingtheDefaultDirectorySchema ................................................. 44
MatchingDatatoSchemaElements .................................................... 45
CustomizingtheSchema ................................................................ 46
WhentoExtendYourSchema......................................................... 47
GettingandAssigningObjectIdentifiers................................................ 47
NamingAttributeandObjectClasses .................................................. 48
StrategiesforDefiningNewObjectClasses ............................................. 48
StrategiesforDefiningNewAttributes ................................................. 50
DeletingSchemaElements............................................................ 50
CreatingCustomSchemaFiles ........................................................ 51
CustomSchemaBestPractices ........................................................ 52
MaintainingConsistentSchema .......................................................... 53
SchemaChecking.................................................................... 54
SelectingConsistentDataFormats ..................................................... 54
MaintainingConsistencyinReplicatedSchema.......................................... 55
OtherSchemaResources ................................................................ 56
Chapter 4 Designing the Directory Tree . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
IntroductiontotheDirectoryTree ........................................................ 57

5
DesigningYourDirectoryTree........................................................... 58
ChoosingaSuffix.................................................................... 58
SuffixNamingConventions ........................................................ 59
NamingMultipleSuffixes.......................................................... 60
CreatingYourDirectoryTreeStructure................................................. 60
BranchingYourDirectory.......................................................... 61
IdentifyingBranchPoints .......................................................... 62
ReplicationConsiderations......................................................... 64
AccessControlConsiderations ..................................................... 66
NamingEntries ..................................................................... 67
NamingPersonEntries ............................................................ 68
NamingGroupEntries ............................................................ 69
NamingOrganizationEntries ...................................................... 70
NamingOtherKindsofEntries ..................................................... 70
GroupingDirectoryEntries.............................................................. 71
AboutRoles ........................................................................ 71
DecidingBetweenRolesandGroups................................................... 72
AboutClassofService ............................................................... 73
DirectoryTreeDesignExamples ......................................................... 74
DirectoryTreeforanInternationalEnterprise ........................................... 74
DirectoryTreeforanISP ............................................................. 75
VirtualDirectoryInformationTreeViews ................................................. 76
Overview........................................................................... 77
IntroductiontoVirtualDITViews ..................................................... 78
AdvantagesofUsingVirtualDITViews ................................................ 81
ExampleofVirtualDITViews......................................................... 82
ViewsandOtherDirectoryFeatures ................................................... 83
EffectsofVirtualViewsOnPerformance ............................................... 84
Compatibility With Existing Applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84
OtherDirectoryTreeResources .......................................................... 85
Chapter 5 Designing the Directory Topology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87
TopologyOverview .................................................................... 87
DistributingYourData.................................................................. 88
AboutUsingMultipleDatabases ...................................................... 89
AboutSuffixes ...................................................................... 90
AboutKnowledgeReferences............................................................ 92
UsingReferrals...................................................................... 92
TheStructureofanLDAPReferral .................................................. 93
AboutDefaultReferrals............................................................ 94
SmartReferrals ................................................................... 94
TipsforDesigningSmartReferrals .................................................. 97
UsingChaining ..................................................................... 98

6 Netscape Directory Server Deployment Guide • August 2002
DecidingBetweenReferralsandChaining .............................................. 99
UsageDifferences................................................................ 100
EvaluatingAccessControls ....................................................... 100
UsingIndexestoImproveDatabasePerformance.......................................... 103
OverviewofDirectoryIndexTypes ................................................... 103
EvaluatingtheCostsofIndexing ..................................................... 104
Chapter 6 Designing the Replication Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105
IntroductiontoReplication ............................................................. 105
ReplicationConcepts................................................................ 106
UnitofReplication ............................................................... 107
Read-WriteReplica/Read-OnlyReplica............................................. 107
Supplier/Consumer.............................................................. 107
ChangeLog ..................................................................... 108
ReplicationAgreement ........................................................... 109
DataConsistency ................................................................... 109
CommonReplicationScenarios ......................................................... 110
Single-MasterReplication............................................................ 110
Multi-MasterReplication ............................................................ 111
CascadingReplication............................................................... 113
MixedEnvironments................................................................ 115
DefiningaReplicationStrategy ......................................................... 117
ReplicationSurvey.................................................................. 118
ReplicationResourceRequirements ................................................... 118
UsingReplicationforHighAvailability ............................................... 119
UsingReplicationforLocalAvailability ............................................... 120
UsingReplicationforLoadBalancing ................................................. 120
ExampleofNetworkLoadBalancing ............................................... 121
ExampleofLoadBalancingforImprovedPerformance ............................... 123
ExampleReplicationStrategyforaSmallSite .......................................... 124
ExampleReplicationStrategyforaLargeSite .......................................... 124
UsingReplicationwithotherDirectoryFeatures........................................... 125
ReplicationandAccessControl....................................................... 125
ReplicationandDirectoryServerPlug-ins ............................................. 125
ReplicationandDatabaseLinks ...................................................... 126
SchemaReplication ................................................................. 127
Chapter 7 Designing a Secure Directory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129
AboutSecurityThreats ................................................................ 129
UnauthorizedAccess ............................................................... 130
UnauthorizedTampering............................................................ 130
DenialofService ................................................................... 131

7
AnalyzingYourSecurityNeeds ......................................................... 131
DeterminingAccessRights .......................................................... 132
EnsuringDataPrivacyandIntegrity .................................................. 132
ConductingRegularAudits.......................................................... 133
ExampleSecurityNeedsAnalysis .................................................... 133
OverviewofSecurityMethods .......................................................... 134
SelectingAppropriateAuthenticationMethods ........................................... 134
AnonymousAccess ................................................................. 135
SimplePassword ................................................................... 136
Certificate-BasedAuthentication ..................................................... 137
SimplePasswordOverTLS .......................................................... 137
ProxyAuthentication ............................................................... 138
PreventingAuthenticationbyAccountInactivation........................................ 138
DesigningaPasswordPolicy ........................................................... 139
PasswordPolicyAttributes .......................................................... 141
PasswordChangeAfterReset ..................................................... 142
User-DefinedPasswords.......................................................... 142
PasswordExpiration ............................................................. 143
ExpirationWarning .............................................................. 143
PasswordSyntaxChecking........................................................ 143
PasswordLength ................................................................ 144
PasswordMinimumAge ......................................................... 144
PasswordHistory................................................................ 144
PasswordStorageScheme......................................................... 144
DesigningaPasswordPolicyinaReplicatedEnvironment............................... 145
DesigninganAccountLockoutPolicy ................................................. 146
DesigningAccessControl .............................................................. 146
AbouttheACIFormat .............................................................. 147
Targets ......................................................................... 148
Permissions ..................................................................... 148
BindRules ...................................................................... 149
SettingPermissions ................................................................. 150
ThePrecedenceRule ............................................................. 150
AllowingorDenyingAccess ...................................................... 150
WhentoDenyAccess ............................................................ 151
WheretoPlaceAccessControlRules ............................................... 152
UsingFilteredAccessControlRules ................................................ 152
UsingACIs:SomeHintsandTricks ................................................... 153
SecuringConnectionsWithSSL ......................................................... 154
OtherSecurityResources............................................................... 155
Chapter 8 DirectoryDesignExamples...........................................157
AnEnterprise......................................................................... 157

8 Netscape Directory Server Deployment Guide • August 2002
DataDesign ....................................................................... 158
SchemaDesign..................................................................... 158
DirectoryTreeDesign............................................................... 159
TopologyDesign ................................................................... 160
DatabaseTopology............................................................... 161
ServerTopology ................................................................. 161
ReplicationDesign.................................................................. 163
SupplierArchitecture............................................................. 163
SupplierConsumerArchitecture................................................... 164
SecurityDesign .................................................................... 165
TuningandOptimizations........................................................... 166
OperationsDecisions ............................................................... 166
AMultinationalEnterpriseanditsExtranet............................................... 166
DataDesign ....................................................................... 167
SchemaDesign..................................................................... 168
DirectoryTreeDesign............................................................... 168
TopologyDesign ................................................................... 170
DatabaseTopology............................................................... 170
ServerTopology ................................................................. 172
ReplicationDesign.................................................................. 174
SupplierArchitecture............................................................. 175
SecurityDesign .................................................................... 177
Glossary .................................................................... 179
Index ....................................................................... 195

9
About This Guide
Welcome to the Netscape Directory Server (Directory Server). This preface includes
the following sections:
• Purpose of This Guide (page 9)
• Directory Server Overview (page 10)
• Conventions Used in This Guide (page 11)
• Related Information (page 12)
Purpose of This Guide
This guide provides you with a foundation for planning your directory. The
information provided here is intended for directory decision makers, designers,
and administrators.
The first chapter of this guide introduces basic directory concepts. Most of the
remainder of the guide covers aspects of directory design, including schema
design, the directory tree, topology, replication, and security. The last chapter
provides sample deployment scenarios to help you plan simple deployments as
well as complex deployments designed to support millions of users distributed
worldwide.

Directory Server Overview
10 Netscape Directory Server Deployment Guide • August 2002
Directory Server Overview
Directory Server provides the following key features:
• Multi-master replication—Provides a highly available directory service for
both read and write operations. Multi-master replication can be combined with
simple and cascading replication scenarios to provide a highly flexible and
scalable replication environment.
• Chaining and referrals—Increases the power of your directory by storing a
complete logical view of your directory on a single server while maintaining
data on a large number of directory servers, transparently for clients.
• Roles and Class of Service—Provides a flexible mechanism for grouping and
sharing attributes between entries in a dynamic fashion.
• Improved access control mechanism—Provides support for macros that
dramatically reduce the number of access control statements used in the
directory, and increase the scalability of access control evaluation.
• Resource-limits by bind DN—Gives you the power to control the amount of
server resources allocated to search operations based on the bind DN of the
client.
• Multiple databases—Provides a simple way of breaking down your directory
data to simplify the implementation of replication and chaining in your
directory service.
• Password Policy and Account Lockout—Allows you to define a set of rules
that govern how passwords and user accounts are managed in the directory
server.
• SSL—Provides secure communications over the network including ciphers
with up to 168-bit encryption.
The major components of Directory Server include:
• An LDAP server—The core of the directory service, provided by the ns-slapd
daemon, and compliant with the LDAP v3 Internet standards.
• Directory Server Console—An improved management console that
dramatically reduces the effort of setting up and maintaining your directory
service. The directory console is part of Netscape Console, the common
management framework for Netscape servers.
• SNMP Agent—Permits you to monitor your directory server in real time using
the Simple Network Management Protocol (SNMP).

Conventions Used in This Guide
About This Guide 11
• Online backup and restore—Allows you to create backups and restore from
backups while the server is running.
Conventions Used in This Guide
This guide uses the following conventions:
Monospaced font—Thistypefaceisusedforanytextthatappearsonthecomputer
screen or text that you should type. It is also used for filenames, functions, and
examples.
Throughout this book you will see path references of the form:
serverRoot/slapd-serverID/...
serverRoot is the installation directory. For Directory Server 5.x and 6.x,
/usr/netscape/servers is the default installation directory on UNIX. On
Windows, it is c:\usr\netscape\servers. If you have installed Directory
Server in a different location, you should adapt the path accordingly.
serverID is the ID or identifier you assigned to an instance of Directory Server
when you installed it. For example, if you gave the server an identifier of
phonebook, then the actual path would look like this:
/usr/netscape/servers/slapd-phonebook/. . .
All paths specified in this manual are in UNIX format. If you are using a
Windows-based Directory Server, you should assume the equivalent file paths
whenever UNIX file paths are shown in this book.
In examples/sample code, paths assume that the Directory Server is installed in the
default location /usr/netscape/servers. If you have installed your Directory
Server in a different location, adapt the paths accordingly. Also, all examples use
phonebook for the server identifier where appropriate.
NOTE Notes, Cautions and Tips mark important information. Make sure
you read this information before continuing.

Related Information
12 Netscape Directory Server Deployment Guide • August 2002
Related Information
The document set for Directory Server also contains the following guides:
•Netscape Directory Server Installation Guide. Contains procedures for installing
your Directory Server as well as procedures for migrating your Directory
Server.
•Netscape Directory Server Administrator’s Guide. Contains procedures for the
day-to-day maintenance of your directory service. Includes information on
configuring server-side plug-ins.
•Netscape Directory Server Configuration, Command, and File Reference. Provides
information about using the command-line scripts shipped with Directory
Server.
•Netscape Directory Server Schema Reference. Provides reference information
about the Netscape Directory Server schema.
•Netscape Directory Server Plug-in Reference Guide. Describes how to write server
plug-ins in order to customize and extend the capabilities of Directory Server.
For a list of documentation installed with Directory Server, open the
/usr/netscape/servers/manual/en/slapd/index.htm file.
For the latest information about Directory Server, including current release notes,
complete product documentation, technical notes, and deployment information,
checkthissite:http://enterprise.netscape.com/docs

13
Chapter 1
Introduction to Directory Server
Netscape Directory Server (Directory Server) provides a centralized directory
service for your intranet, network, and extranet information. Directory Server
integrates with existing systems and acts as a centralized repository for the
consolidation of employee, customer, supplier, and partner information. You can
extend Directory Server to manage user profiles and preferences, as well as
extranet user authentication.
This chapter describes the basic ideas you need to understand before designing
your directory. It includes the following sections:
• What is a Directory Service? (page 13)
• Introduction to Directory Server (page 15)
• Directory Design Overview (page 21)
• Other General Directory Resources (page 23)
What is a Directory Service?
The term directory service means the collection of software, hardware, and
processes that store information about your enterprise, subscribers, or both and
make that information available to users. A directory service consists of at least one
instance of Directory Server and one or more directory client programs. Client
programs can access names, phone numbers, addresses, and other data stored in
the directory.
One common directory service is a Domain Name System (DNS) server. A DNS
server maps a computer host name to an IP address. Thus, all of the computing
resources (hosts) become clients of the DNS server. The mapping of host names
allows users of your computing resources to easily locate computers on your
network by remembering host names rather than numerical IP addresses.

What is a Directory Service?
14 Netscape Directory Server Deployment Guide • August 2002
However, the DNS server stores only two types of information: names and IP
addresses. A true directory service stores virtually unlimited types of information.
Directory Server stores all of your information in a single, network-accessible
repository. The following are a few examples of the kinds of information you might
store in a directory:
• Physical device information, such as data about the printers in your
organization (where they reside, whether they are color or black and white,
their manufacturer, date of purchase, and serial number)
• Public employee information, such as name, email address, and department
• Private employee information, such as salary, government identification
numbers, home addresses, phone numbers, and pay grade
• Contract or account information, such as the name of a client, final delivery
date, bidding information, contract numbers, and project dates
Directory Server serves the needs of a wide variety of applications. It also provides
a standard protocol and application programming interfaces (APIs) to access the
information it contains.
The following sections describe global directory services and the Lightweight Data
Access Protocol (LDAP).
About Global Directory Services
Directory Server provides global directory services, meaning it provides
information to a wide variety of applications. Until recently, many applications
came bundled with their own proprietary databases. While a proprietary database
can be convenient if you use only one application, multiple databases become an
administrative burden if the databases manage the same information.
For example, suppose your network supports three different proprietary email
systems, each system with its own proprietary directory service. If users change
their passwords in one directory, the changes are not automatically replicated in
the others. Managing multiple instances of the same information results in
increased hardware and personnel costs, a problem referred to as the n + 1
directory problem.

Introduction to Directory Server
Chapter 1 Introduction to Directory Server 15
A global directory service solves the n+1 directory problem by providing a single,
centralized repository of directory information that any application can access.
However, giving a wide variety of applications access to the directory requires a
network-based means of communicating between the applications and the
directory. Directory Server uses LDAP (Lightweight Directory Access Protocol) to
give applications access to its global directory service.
About LDAP
LDAP provides a common language that client applications and servers use to
communicate with one another. LDAP is a “lightweight” version of the Directory
Access Protocol (DAP) used by the ISO X.500 standard. DAP gives any application
access to the directory via an extensible and robust information framework, but at
an expensive administrative cost. DAP uses a communications layer that is not the
Internet standard TCP/IP protocol and has complicated directory-naming
conventions.
LDAP preserves the best features of DAP while reducing administrative costs.
LDAP uses an open directory access protocol running over TCP/IP and uses
simplified encoding methods. It retains the X.500 standard data model and can
support millions of entries for a modest investment in hardware and network
infrastructure.
Introduction to Directory Server
Directory Server includes the directory itself, the server-side software that
implements the LDAP protocol, and a graphical user interface that allows
end-users to search and change entries in the directory. Other LDAP clients are
also available, including the directory managers in the Netscape Console and the
Address Book feature in Netscape Communicator 4.x. In addition, you can
purchase other LDAP client programs or write your own using the LDAP client
SDK included with the Directory Server product.
Without adding other LDAP client programs, Directory Server can provide the
foundation for your intranet or extranet. Every Netscape server uses the directory
as a central repository for shared server information, such as employee, customer,
supplier, and partner data.

Introduction to Directory Server
16 Netscape Directory Server Deployment Guide • August 2002
You can use Directory Server to manage extranet user-authentication, create access
control, set up user preferences, and centralize user management. In hosted
environments, partners, customers, and suppliers can manage their own portions
of the directory, reducing administrative costs.
When you install Directory Server, the following components are installed on your
machine:
• An LDAP server (Directory Server) with a plug-in interface
The name of this process is ns-slapd.
• Netscape Administration Server
For more information about the Administration Server, see Managing Servers
with Netscape Console.
• Netscape Console to manage the servers
For more information about the Netscape Console, see Managing Servers with
Netscape Console.
• Command-line tools for starting and stopping the server, importing and
exporting data in the database, database reindexing, account inactivation and
deactivation, LDIF merges, and kernel tuning
For more information about the command-line tools, refer to Netscape Directory
Server Configuration, Command, and File Reference.
•AnSNMPmonitor
For more information about SNMP monitoring, refer to the Netscape Directory
Server Administrator’s Guide.
This guide talks about the core Directory Server and the plug-ins it uses for doing
its work. The next sections describe Directory Server in more detail. The topics
discussed are:
• “Overview of Directory Server Architecture,” on page 16
• “Directory Server Data Storage,” on page 19
Overview of Directory Server Architecture
At installation, Directory Server contains the following:
• A server front-end responsible for network communications
• Plug-ins for server functions, such as access control and replication

Introduction to Directory Server
Chapter 1 Introduction to Directory Server 17
• A basic directory tree containing server-related data.
The following sections describe each component of the directory in more detail.
Overview of the Server Front-End
The server front-end of Directory Server manages communications with directory
client programs. Directory Server functions as a daemon on UNIX systems and as a
service on Windows. Multiple client programs can speak to the server in LDAP.
They can communicate using LDAP over TCP/IP. The connection can also be
protected with SSL/TLS, depending on whether the client negotiates the use of
Transport Layer Security (TLS) for the connection.
When communication takes place with TLS, the communication is usually
encrypted. In the future, when DNS security is present, TLS used in conjunction
with secured DNS will provide confirmation to client applications that they are
binding to the correct server. If clients have been issued certificates, TLS can be
used by Directory Server to confirm that the client has the right to access the server.
TLS and its predecessor SSL are used throughout Netscape server products to
perform other security activities such as message integrity checks, digital
signatures, and mutual authentication between servers.
Multiple clients can bind to the server at the same time over the same network
because the Directory Server is a multi-threaded application. As directory services
grow to include larger numbers of entries or larger numbers of clients spread out
geographically, they also include multiple Directory Servers placed in strategic
places around the network.
Server Plug-ins Overview
Directory Server relies on plug-ins. A plug-in is a way to add functionality to the
core server. For example, a database is a plug-in.
A plug-in can be disabled. When disabled, the plug-in’s configuration information
remains in the directory but its function will not be used by the server. Depending
upon the what you want your directory to do, you can choose to enable any of the
plug-ins provided with Directory Server.
Netscape Professional Services can write custom plug-ins for your Directory Server
deployment. Contact Netscape Professional Services for more information.

Introduction to Directory Server
18 Netscape Directory Server Deployment Guide • August 2002
Overview of the Basic Directory Tree
The directory tree, also known as a directory information tree or DIT, mirrors the
tree model used by most file systems, with the tree’s root, or first entry, appearing
at the top of the hierarchy. At installation, Directory Server creates a default
directory tree.
The default directory tree appears as follows:
The root of the tree is called the root suffix. For information about naming the root
suffix, refer to “Choosing a Suffix,” on page 58.
At installation, the directory contains up to four subtrees under your root suffix:
•cn=config
This subtree contains information about the server’s internal configuration.
•o=NetscapeRoot
This subtree contains the configuration information of other Netscape servers,
such as Administration Server. The Administration Server takes care of
authentication and all actions that cannot be performed through LDAP (such
as starting or stopping).
•o=userRoot
During installation, a user database is created by default. Its default name is
o=userRoot. You can choose to populate it at installation time, or populate
later.
NOTE When you install another instance of Directory Server, you can
specify that it does not contain the o=NetscapeRoot information,
that it uses the configuration directory (or the o=NetscapeRoot
subtree) present on another server. See the Netscape Directory Server
Installation Guide for more information about deciding upon the
location of your configuration directory.

Introduction to Directory Server
Chapter 1 Introduction to Directory Server 19
You can build on the default directory tree to add any data relevant to your
directory installation. An example of a directory tree for example.com Corporation
follows:
For more information about directory trees, refer to Chapter 4, “Designing the
Directory Tree.”
Directory Server Data Storage
Your directory data is stored in an LDBM database. The LDBM database is
implemented as a plug-in that is automatically installed with the directory and is
enabled by default.
The database is the basic unit of storage, performance, replication, and indexing.
You can do operations like importing, exporting, backing up, restoring, and
indexing on the database.
By default, Directory Server uses a single database to contain the directory tree.
This database can manage millions of entries. The default database supports
advanced methods of backing up and restoring your data, so that your data is not
at risk.
You can choose to use multiple databases to support your Directory Server. You
can distribute your data across the databases, allowing the server to hold more
data than can be stored in a single database.
The following sections describe how a directory database stores data.

Introduction to Directory Server
20 Netscape Directory Server Deployment Guide • August 2002
About Directory Entries
LDIF is a standard text-based format for describing directory entries. An entry is a
group of lines in the LDIF file that contains information about an object, such as a
person in your organization or a printer on your network. Information about the
entry is represented in the LDIF file by a set of attributes and their values. Each
entry has an object class attribute that specifies the kind of object the entry
describes and defines the set of additional attributes it contains. Each attribute
describes a particular trait of an entry.
For example, an entry might be of an object class organizationalPerson,
indicating that the entry represents a person within a particular organization. This
object class allows the givenname and telephoneNumber attributes. The values
assigned to these attributes give the name and phone number of the person
represented by the entry.
Directory Server also uses read-only attributes that are calculated by the server.
These attributes are called operational attributes. There are also some operational
attributes that can be set by the administrator, for access control and other server
functions.
Entries are stored in a hierarchical structure in the directory tree. In LDAP, you can
query an entry and request all entries below it in the directory tree. This subtree is
calledthebasedistinguishedname,orbaseDN.Forexample,ifyoumakean
LDAP search request specifying a base DN of ou=people, dc=example,dc=com,
then the search operation examines only the ou=people subtree in the
dc=example,dc=com directory tree.
However, all entries are not automatically returned in response to an LDAP search.
This is because Directory Server 6.x introduces a new kind of entry, entries of the
object class ldapsubentry.Anldapsubentry entry represents an administrative
object, for example entries used to define a role or a class of service are of the
ldapsubentry type. Entries of type ldapsubentry are not returned in response to
normal search requests. To receive these entries, clients need to search specifically
for entries of the ldapsubentry object class.
For more information about roles, see “About Roles,” on page 71. For more
information about class of service, see “About Class of Service,” on page 73.
Distributing Directory Data
When you store various parts of your tree in separate databases, your directory can
process client requests in parallel, improving performance. You can also store your
databases on different machines, to further improve performance.