Solaris and LDAP Naming Services is a practical guide to implementing Solaris 8 native LDAP on clients and servers. Basic LDAP concepts are covered, as well as naming and authentication architectural details. This BluePrint outlines strategies for consolidating legacy directory services using LDAP technology.
Click here for a sample chapter for this book: 0130306789.pdf
1. Solaris Naming Services Overview.
Definition of a Naming Service. Definition of a Directory Service. Directory Service versus Database Servers. Proliferation of Directory Services. Solaris Directory ServicesÑHistorical Perspective. Network Information Service. NIS+. Domain Name System. Solaris Naming Service Switch. LDAP Background. Brief History of LDAP. LDAP Goals and Specifications. Solaris LDAP Implementation. Factors to Consider When Deploying LDAP.
Evolution of Solaris Naming Services. NIS and Files Coexistence. NIS and DNS Coexistence. Solaris Naming Service Switch. NIS Architecture Overview. NIS Client Server Architecture. How NIS Clients Bind to the NIS Server. NIS Maps. NIS High Availability Architecture Features. NIS+ Architecture Overview. NIS+ Client Server Architecture. How NIS+ Clients Bind to the NIS+ Server. NIS+ Tables. NIS+ Interaction with DNS. NIS+ High Availability Architecture Features. Solaris DNS Architecture Overview. DNS Client Architecture. DNS Server Architecture. DNS High Availability Features. LDAP Architecture Overview. LDAP Information Model. LDAP Naming Model. LDAP Functional Model. LDAP Security Model. LDAP Replication. Comparison with Legacy Naming Services.
Authentication versus Authorization. Traditional Solaris Authentication. How UNIX Passwords Work. NIS+ Credentials. Alternative Authentication Mechanisms. LDAP Authentication (Simple Authentication). CRAM-MD5. Kerberos. Secure Socket Layer Authentication. Security Infrastructure. Planet Directory Server SASL. Solaris PAM Framework. PAM Module Types. How PAM Works. PAM Configuration File. Generic pam.conf File. PAM LDAP Module. How PAM and LDAP Work.
Product Architecture. Administration Domains. Configuration Data. Login Accounts. Netscape Console. Planning the Installation. Installation Procedure. Performing a Typical Installation. Installation Defaults. Starting the Netscape Console. Verifying the Installation. Installation File Navigation. Postinstallation Procedures. Changing Common Installation Configuration Parameters. Importing Directory Data. Reinstalling iPlanet Directory Server. Installation Troubleshooting Tips. Directory Replication. Planning Directory Replication. Verifying Replication. Troubleshooting Replication Problems. Modifying the Supplier Initiated Agreement. Setting up a Secure System Using SSL and Certificates. Planning a Secure Server Configuration. Running the Certificate Setup Wizard. Rebooting the Secure Server. Changing the Trust Database Password or PIN. Using SSL for Replication. iPlanet Directory Server Startup Files. Script Generation Program. Installing the NIS Extensions.
Definition of Native LDAP. Native Solaris LDAP Implementation. Solaris LDAP Client Profiles. NIS Domain. Authentication Method. Proxy Agent. Directory Information Tree. Loading Data. Naming Context. Server Configuration Procedure. Tools and Techniques. Importing LDIF Files from the Command Line. Summary of Steps Required. Client Configuration. How LDAP Clients Initialize. LDAP Client Initialization Example. Troubleshooting Tips. Unresolved Host Name. Unable to Reach Systems in the LDAP Domain Remotely. Sendmail Fails to Deliver/Receive Mail To/From Remote Users. Login Does Not Work.
Overview. What the Extensions Are. Storing NIS Information in LDAP. NIS Extensions Initialization. Initialization Checklist. Postinstallation Verification.
Server Sizing. Directory Considerations. Directory Size. Directory Access. Security Requirements. Replication Strategy. Capacity Planning Methodology. Calculating Directory Database Size. Summary of Disk Storage Requirements. Memory Sizing. Summary of Memory Usage. Estimating CPU Usage. LDAP Test Suite. Results of Experimentation. Configuration. Simple Read Test with Persistent Connection. Read Test with Nonpersistent Connection. Modify Tests. Authentication Tests. Qualitative Observations Based on Test Results. Performance Tuning. Definition of Indexing. Indexing Summary. Caching for Performance. Directory Caches. Evaluating Sizing Factors. Setting the Database Cache Size. Setting Entry Cache Size. Sizing the Database and Entry Caches. Tuning Cache Sizes. Setting the All IDs Threshold. Tuning the All IDs Threshold Value. Setting Search Limit Parameters. Considering Data Design Issues. Designing an LDAP Client. Removing Unnecessary Plug-ins. Tuning Write Performance. Tuning Import Performance. Troubleshooting Checklist.
iPlanet Directory Services 4.12 HA Architecture Models. High Availability Strategy. Overview of Sun Cluster 2.2 Software. Logical IP Addresses. Data Services for Sun Cluster. Building a Sun Cluster with HA LDAP Data Services. LDAP Fault Monitor. iPlanet Directory Server 4.12 Installation. Configuring the Sun Cluster HA for iPlanet Data Services. LDAP Cluster Deployment Options. Asymmetric (Hot Standby Model) HA. Active Server Model. Redirecting LDAP Client Requests.
Directory Log Files. Access Log. Viewing the Access Log. Access Log Configuration Options. Error Log. Viewing the Error Log. Audit Log. Managing Database Transaction Logging. Changing the Location of the Database Transaction Log. Changing the Database Checkpoint Interval. Enabling Durable Transactions. Backing Up and Restoring the Directory Database. Backing Up the Database from the Directory Server Console. Backing Up the Database from the Command Line. Restoring the Database from the Directory Server Console. Restoring Your Database from the Command Line. Deleting Database Backups. Restoring Databases That Include Replicated Entries. Placing a Database in Read-Only Mode. Exporting and Importing the Database with LDIF. Exporting Databases to LDIF from the Command Line. Importing Databases from LDIF.
Establishing Access Control Policies. LDAP Security Model Review. Access Control Instructions. Creating Access Control Instructions. Managing the Directory Schema. The Schema Files. How Schema Files Are Read. Modifying the Schema. Monitoring the Directory Server. Monitoring Resources. Monitoring the Server from the Command Line. Monitoring Database Activity. Monitoring the Database from the Directory Server Console. Monitoring the Database from the Command Line. Managing with SNMP. Using LDAP MIB. Managing the LDAP Directory Server with BMC PATROL. iPlanet Directory Server KM Overview. Introduction to BMC PATROL. Checking Memory Usage with pmap.
Benefits of Consolidation. LDAP as a Consolidation Choice. Consolidation Approaches. Consolidation of LDAP-Enabled Applications. LDAP Gateways. LDAP Synchronization. Password Synchronization. NIS Extensions for Solaris. NT Synchronization Service. iPlanet Meta-Directory Server. How Meta-Directory Works. Meta-Directory Connectors. Deploying iPlanet Meta-Directory. Unified Login and Single Sign-on. Kerberos and LDAP. SiteMinder. iPlanet Directory Access Router. iDAR Overview. iPlanet Directory Access Router Feature Set.
Windows NT Interoperability. Windows NT Security Model. How the NT User Account Information Is Made Available to Solaris Server. Mapping NT User Account Information to LDAP. How the Synchronization Service Works. Windows 2000 Interoperability. Active Directory Services Architecture. Information Model. Security Model. Access Model. Replication Model. How Active Directory Clients Interact with Servers. How Applications Access Active Directory Services. Solaris Directory Services and Active Directory Services Interactions. Signing On Only Once. Joining a Windows 2000 Tree or Forest. Specifying LDAP Referrals. Using Windows Services in UNIX 2.0. IETF Schemas. RFC 2307 Network Information Service Schema. RFC 2307 Draft Objectclasses. Mail Alias Schema.
This book is one of an on-going series of books collectively known as the Sun BluePrints program. The Solaris and LDAP Naming Services BluePrint describes best practices for planning and deploying naming services based on the Lightweight Directory Access Protocol (LDAP). The introduction of native LDAP in the Solaris 8 operating environment provides powerful capabilities but is based on a model unfamiliar to most Solaris system administrators. Understanding general LDAP concepts and the specific Solaris implementation is key to successful deployment of resilient enterprise-wide naming services.
The mission of the Sun BluePrints Program is to empower Sun customers with the technical knowledge required to implement reliable, extensible, and secure information systems within the data center using Sun products. The Sun BluePrints Program is managed by the Enterprise Engineering Group, which is part of the Customer Quality and Availability organization. This group provides a framework to identify, develop, and distribute best practices information that applies across the Sun product lines. Technical subject matter experts in various areas contribute to the program and focus on the scope and usefulness of the information.
The Enterprise Engineering Group is the primary provider of the technical content of the Sun BluePrints Program that includes books, guides, and online articles. Through these vehicles, Sun can provide guidance, installation and implementation experiences, real-life scenarios, and late-breaking technical information.
The monthly electronic magazine, Sun BluePrints OnLine, is located on the Web at
http://www.sun.com/blueprints. To be notified about updates to the Sun BluePrints Program, please register yourself on this site.
This book is primarily intended for two types of readers: IT planners and system administrators. IT planners who must decide how to implement their future corporate naming services infrastructure will find the chapters Capacity Planning and Performance Tuning, Directory Services Consolidation, and Microsoft Windows Interoperability useful. System administrators will find helpful installation and management tips in the chapters iPlanet Directory Server Installation and Configuration, Solaris 8 Native LDAP Configuration, NIS Extensions Configuration, Deploying Highly Available LDAP Data Services, and Preventive Maintenance, Managing Directory Services.
You should be familiar with basic Solaris system administration functions and possess some understanding of NIS or NIS+ and DNS. Some knowledge of LDAP concepts is helpful, but not required.
This book contains the following chapters and appendixes.
Chapter 1, "Solaris Naming Services Overview," introduces to naming service concepts and the Sun implementation of these concepts in the Solaris operating environment. The chapter discusses how the Solaris naming service infrastructure evolved into what it is today and why naming services are important.
Chapter 2, "Solaris Naming Services Architecture," explains how naming services are plugged into the Solaris operating environment and how Solaris clients interact with naming services. The Solaris Naming Service Switch is discussed in detail. An overview of NIS and NIS+ features is presented and contrasted with the Solaris 8 LDAP implementation.
Chapter 3, "Security Models," details the role naming services and directories play in authentication services. The Solaris Pluggable Authentication Module (PAM) infrastructure is discussed in detail to show how new authentication methods, such as LDAP binding, are integrated. When to deploy them and how the various authentication methods such as Public Key Infrastructure (PKI), Kerberos, and UNIX crypt work is discussed.
Chapter 4, "iPlanet Directory Server Installation and Configuration," describes how to install and configure the core components of the iPlanet Directory Server that ships with the Solaris 8 operating environment. Configuration tips that improve the directory performance and availability are included.
Chapter 5, "Solaris 8 Native LDAP Configuration," explains how to configure the iPlanet Directory Server to support the LDAP features in the Solaris 8 operating environment. A discussion of the directory schema extensions required to support Solaris 8 LDAP clients is presented.
Chapter 6, "NIS Extensions Configuration," describes how to configure the iPlanet Directory Server to support the NIS extensions and how to bulk-load NIS maps into the directory. How the iPlanet Directory Server running the extensions interacts with real NIS servers is explained.
Chapter 7, "Capacity Planning and Performance Tuning," presents heuristics, based on past deployments and benchmark results, for sizing a directory. Procedures for optimizing directory server performance are included.
Chapter 8, "Deploying Highly Available LDAP Data Services," describes when to cluster the iPlanet Directory Server and how to deploy Sun Cluster software running the Data Services for LDAP. Alternative methods, such as directory replication, to clustering are presented along with deployment scenarios.
Chapter 9, "Preventive Maintenance," explains how to perform routine directory maintenance such as pruning log files and backing up the directory database. How to examine the directory log files and spot potential problems is presented.
Chapter 10, "Managing Directory Services," discusses the use of the iPlanet Directory Server tools to perform routine directory management functions like setting access control policies, updating the directory schema, and monitoring the health of the directory server. SNMP management with the LDAP Management Information Base (MIB) and deployment of BMC PATROL to monitor the iPlanet Directory Server are explained.
Chapter 11, "Directory Services Consolidation," presents an overview of the iPlanet Meta-Directory Server and describes how it can be used to unify disparate data sources. Creating a single-sign-on environment with SiteMinder is also explained.
Chapter 12, "Microsoft Windows Interoperability," explains how the iPlanet Windows NT Synchronization services can be deployed to provide an unified login between Windows clients and the iPlanet Directory Server. Windows 2000 Active Directory Services is introduced, followed by a discussion of how it can interoperate with the Solaris 8 operating environment.
Appendix A, "Using Netscape Communicator as an LDAP Client" is a procedure for extending the LDAP features in Netscape Communicator so directory data can be viewed and searched.
Appendix B, "LDAP Standards Information" lists RFCs and other standards that define LDAP.
Appendix C, "Additional Information," lists sources of helpful information and LDAP related tools.
Appendix D, "LDAP v3 Result Codes" describes error messages that iDS generates.
Appendix E, "Schema Information" describes the LDAP object classes and attributes required to support native Solaris LDAP.
Glossary is a list of terms and acronyms used frequently in describing naming, directory, and authentication services.
The SunDocs program provides more than 250 manuals from Sun Microsystems, Inc. If you live in the United States, Canada, Europe, or Japan, you can purchase documentation sets or individual manuals through this program.
The docs.sun.com Web site enables you to access Sun technical documentation online. You can browse the docs.sun.com archive or search for a specific book title or subject. The URL is