Related Manuals for Novell EDIRECTORY 8.8 SP5 - GUIDE 12-2009
Summary of Contents for Novell EDIRECTORY 8.8 SP5 - GUIDE 12-2009
- Page 1 AUTHORIZED DOCUMENTATION What’s New Guide Novell ® eDirectory 8.8 SP5 December 02, 2009 www.novell.com Novell eDirectory 8.8 What's New Guide...
- Page 2 Further, Novell, Inc. reserves the right to make changes to any and all parts of Novell software, at any time, without any obligation to notify any person or entity of such changes.
- Page 3 Novell is a registered trademark of Novell, Inc., in the United States and other countries. Novell Client is a trademark of Novell, Inc. Novell Directory Services and NDS are registered trademarks of Novell, Inc., in the United States and other countries.
- Page 4 Novell eDirectory 8.8 What's New Guide...
-
Page 5: Table Of Contents
Contents About This Guide 1 Supported Platforms for eDirectory Installation Netware ..............11 Linux. - Page 6 Upgrading the Legacy Novell Clients and Utilities ........
- Page 7 11 Bulkload Performance 12 iManager ICE Plug-ins 12.1 Adding Missing Schema............65 12.1.1 Add Schema from a File .
- Page 8 Nested Groups ............. 90 Novell eDirectory 8.8 What's New Guide...
-
Page 9: About This Guide
We want to hear your comments and suggestions about this manual and the other documentation included with this product. Please use the User Comments feature at the bottom of each page of the online documentation, or go to www.novell.com/documentation/feedback.html and enter your comments there. - Page 10 ® A trademark symbol ( , etc.) denotes a Novell trademark. An asterisk (*) denotes a third-party trademark. When a single pathname can be written with a backslash for some platforms or a forward slash for other platforms, the pathname is presented with a backslash.
-
Page 11: Supported Platforms For Edirectory Installation
Supported Platforms for eDirectory Installation eDirectory 8.8 SP5 is a cross-platform release aimed at improving the stability of eDirectory. 1.1 Netware The supported platforms for eDirectory 8.8 SP5 installation on Netware are as follows: OES2 Netware 6.5 SP7 OES2 SP1 NetWare 6.5 SP8 1.2 Linux The supported platforms for eDirectory 8.8 SP5 installation on Linux are as follows: 32-bit eDirectory supported platforms:... -
Page 12: Solaris
For more information on Solaris* Zones and on installing eDirectory 8.8 SP5 on a Solaris* Zones system refer to the Novell eDirectory 8.8 Installation Guide (http://www.novell.com/ documentation/edir88/edirin88/data/a2iii88.html) 1.4 AIX The supported platform for eDirectory 8.8 SP5 installation on AIX is AIX* 5L Version 5.3. - Page 13 NOTE: The service name (display name) for 64-bit eDirectory starts with . And, x64 NDS Server the service name for 32-bit eDirectory starts with x86 NDS Server Supported Platforms for eDirectory Installation...
- Page 14 Novell eDirectory 8.8 What's New Guide...
-
Page 15: Install And Upgrade Enhancements
Install and Upgrade Enhancements ® This chapter discusses the new features and enhancements with the Novell eDirectory installation and upgrade. The following table lists the new features and specifies the platforms they are supported on. Feature NetWare Linux UNIX Windows Multiple package formats for installing eDirectory 8.8... -
Page 16: Multiple Package Formats For Installing Edirectory 8.8
With eDirectory 8.8, you can install eDirectory on a host that has the ZENworks Linux Management server installed and then roll it out to the other servers that have installed ZENworks Linux Management clients. Novell eDirectory 8.8 What's New Guide... -
Page 17: Installing And Configuring Edirectory Through Yast
On SLES 9.1 or otherwise known as Open Enterprise Server (OES), you can install and configure eDirectory 8.8 through YaST. For more information on installing and configuring eDirectory through YaST, refer to the Novell eDirectory 8.8 Installation Guide (http://www.novell.com/documentation/edir88/edirin88/data/ a79kg0w.html#bv1lxl8). 2.4 Installing eDirectory 8.8 in a Custom Location eDirectory 8.8 gives you the flexibility to install the application, data, and configuration files in a... -
Page 18: Specifying A Custom Location For Application Files
Therefore, you cannot choose a custom DIB path on NetWare. Windows On Windows you would be prompted to enter the DIB path during the installation. Enter a path of your choice. Novell eDirectory 8.8 What's New Guide... -
Page 19: Specifying A Custom Location For Configuration Files
For more details on the Multiple Instances feature, refer to Multiple Instances Upgrading Multiple Instances (http://www.novell.com/documentation/edir88/edirin88/data/af7r5d7.html). Nonroot installation and configuration is applicable to Linux and UNIX platforms only. For more information on nonroot installation and configuration, refer to Nonroot User Installing eDirectory (http://www.novell.com/documentation/edir88/edirin88/data/ai3a2wy.html). -
Page 20: Fhs Compliance
After entering the above command, run the utilities as you would normally do. Call the script in your profile, bashrc, or similar scripts. Therefore, whenever you log in or open a new shell, you can start using the utilities directly. Novell eDirectory 8.8 What's New Guide... -
Page 21: Lsb Compliance
2.6.2 LSB Compliance eDirectory 8.8 is now Linux Standard Base (LSB) compliant. LSB also recommends FHS compliance. All the eDirectory packages in Linux are prefixed with novell. For example, NDSserv novell-NDSserv 2.7 Server Health Checks eDirectory 8.8 introduces server health checks that help you determine whether your server health is safe before upgrading. -
Page 22: Types Of Health Checks
This is the first stage of the health check.The health check utility checks for the following: 1. The eDirectory service is up. The DIB is open and able to read some basic tree information such as the tree name. 2. The server is listening on the respective port numbers. Novell eDirectory 8.8 What's New Guide... -
Page 23: Categorization Of Health
For LDAP, it gets the TCP and the SSL port numbers and checks if the server is listening on these ports. Similarly, it gets the HTTP and HTTP secure port numbers and checks if the server is listening on these ports. Partitions and Replica Health After checking the basic server health, the next step is to check the partitions and replica health as follows:... - Page 24 1. Unable to read or open the DIB. The DIB might be locked or corrupt. 2. Unable to contact all the servers in the replica ring. 3. Locally held partitions are busy. 4. Replica is not in the ON state. For more information, see the following figure. Novell eDirectory 8.8 What's New Guide...
-
Page 25: Log Files
The health check log file contains the following: Status of the health checks (normal, warning, or critical). URLs to the Novell support site. The following table gives you the locations for the log file on the various platforms: Install and Upgrade Enhancements... -
Page 26: Secretstore Integration With Edirectory
2.8 SecretStore Integration with eDirectory ® eDirectory 8.8 gives you an option to configure Novell SecretStore 3.4 during eDirectory configuration. Prior to eDirectory 8.8, you had to manually install SecretStore. SecretStore is a simple and secure password management solution. It enables you to use a single authentication to eDirectory to access most UNIX, Windows, Web, and mainframe applications. -
Page 27: Unattended Upgrade To Edirectory 8.8 Sp5 On Netware
Netware” in the eDirectory 8.8 Installation Guide. 2.10 eDirectory Instrumentation Installation Earlier eDirectory Instrumentation was a part of Novell Audit. From eDirectory 8.8 SP3 version onwards, eDirectory Instrumentation must be installed separately. For detailed information on installing, configuring, and uninstalling eDirectory Instrumentation refer to the eDirectory Instrumentation section of the Novell eDirectory 8.8 Installation Guide (http:/... - Page 28 Novell eDirectory 8.8 What's New Guide...
-
Page 29: Nici Backup And Restore
NICI Backup and Restore Novell International Cryptography Infrastructure (NICI) stores keys and user data in the file system and in system and user specific directories and files. These directories and files are protected by setting the proper permissions on them using the mechanism provided by the operating system. This is done by the NICI installation program. - Page 30 Novell eDirectory 8.8 What's New Guide...
-
Page 31: The Ndspassstore Utility
From the eDirectory 8.8 SP5 release, this utility is used to set the SAdmin password. This utility is available by default at in Windows and at C:\Novell\NDS /opt/novell/ in UNIX. eDirectory/bin Command Synopsis You could use the ndspassstore utility by enterning the following command at the server console: ndspassstore -a <adminContext>... - Page 32 Novell eDirectory 8.8 What's New Guide...
-
Page 33: Migrating Edirectory 8.8 Sp5 From Netware To Oes
Hardware and supported platform requirements are aligned with the corresponding Cypress supported platform matrix. For more information, refer to Novell eDirectory Installation Guide (http://www.novell.com/ documentation/edir88/edirin88/data/a2iii88.html). Migrating eDirectory 8.8 SP5 from Netware to OES 2.0... - Page 34 Novell eDirectory 8.8 What's New Guide...
-
Page 35: Multiple Instances
Multiple Instances ® Traditionally, you could configure only one instance of Novell eDirectory on a single host. With the multiple instances feature support in eDirectory 8.8, you can configure the following: Multiple instances of eDirectory on a single host Multiple trees on a single host Multiple replicas of the same tree or partition on a single host eDirectory 8.8 also provides you with a utility (ndsmanage) to easily track the instances. -
Page 36: Using Multiple Instances
NOTE: All the instances share the same server key (NICI). Option Description --config-file Specifies the absolute path and filename to store the nds.conf configuration file. For example, to store the configuration file in the /etc/opt/novell/ eDirectory/ directory, use --config-file /etc/opt/novell/eDirectory/nds.conf. Novell eDirectory 8.8 What's New Guide... -
Page 37: Managing Multiple Instances
Option Description Specifies the port number where the new instance should listen. NOTE: -b and -B are exclusively used. Specifies the port number along with the IP address or interface. For example: -B eth0@524 -B 100.1.1.2@524 NOTE: -b and -B are exclusively used. Creates the data , and... - Page 38 2 Enter c to create a new instance. You can either create a new tree or add a server to an existing tree. Follow the instructions on the screen to create a new instance. Novell eDirectory 8.8 What's New Guide...
- Page 39 Performing Operations for a Specific Instance You can perform the following operations for every instance: “Starting a Specific Instance” on page 39 “Stopping a Specific Instance” on page 39 “Deconfiguring an Instance” on page 40 Other than the ones listed above, you can also run ndstrace for a selected instance. Starting a Specific Instance To start an instance configured by you, do the following: 1 Enter the following:...
-
Page 40: Identifying A Specific Instance
This hostname and port number are the instance identifiers. Most of the utilities have the -h hostname:port or --config-file configuration_file_location option that enables you to specify a particular instance. See the man pages of the utilities for more information. Novell eDirectory 8.8 What's New Guide... -
Page 41: Invoking A Utility For A Specific Instance
To configure the instances based on the above mentioned instance identifiers, Mary must enter the following commands. Instance 1: ndsconfig new -t mytree -n o=novell -a cn=admin.o=company -b 1524 -D /home/mary/inst1/var --config-file /home/mary/inst1/nds.conf Instance 2: ndsconfig new -t corptree -n o=novell -a cn=admin.o=company -b 2524 -D /home/mary/inst2/var --config-file /home/mary/inst2/nds.conf... -
Page 42: Invoking A Utility For An Instance
-a 6.6 For More Information Refer to the following documents for more information about Multiple Instances Support: Novell eDirectory 8.8 Install Guide (http://www.novell.com/documentation/edir88/edirin88/ data/a79kg0w.html#bqs8mmt) For Linux and UNIX: ndsconfig and ndsmanage man pages Novell eDirectory 8.8 What's New Guide... -
Page 43: Authentication To Edirectory Through Sasl-Gssapi
For more information, refer to RFC 1510 (http://www.ietf.org/rfc/rfc1510.txt?number=1510). For more information on Novell Kerberos KDC, refer to the Novell Kerberos KDC documentation (http://www.novell.com/documentation/kdc/index.html). 7.1.2 What is SASL? Simple Authentication and Security Layer (SASL) provides an authentication abstraction layer to applications. -
Page 44: What Is Gssapi
1 An eDirectory user sends a request through an LDAP client to the Kerberos KDC (Key Distribution Center) server for an initial ticket known as a ticket granting ticket (TGT). A Kerberos KDC can be from Novell Kerberos KDC MIT, Microsoft*, or Heimdal. 2 KDC responds to the LDAP client with a TGT. -
Page 45: Configuring Gssapi
2e Associate a Kerberos principal name with the User Object. For information on the above steps, refer to the Configuring GSSAPI with eDirectory in Novell eDirectory 8.8 Administration Guide (http://www.novell.com/documentation/ edir88/index.html?treetitl.html) 7.4 How Does LDAP Use GSSAPI? After you configure GSSAPI, it is added along with the other SASL methods to the supportedSASLMechanisms attribute in rootDSE. -
Page 46: Commonly Used Terms
A record containing client information, service information, and a session key which is encrypted with the particular service principal’s shared key Ticket Granting Ticket A type of ticket that the client can obtain additional Kerberos tickets (TGT) with. Novell eDirectory 8.8 What's New Guide... -
Page 47: Enforcing Case-Sensitive Universal Passwords
Now, in eDirectory 8.8 and later, you can make your passwords case-sensitive for all the clients that are upgraded to eDirectory 8.8. By enforcing the use of case-sensitive passwords, you can prevent the legacy Novell clients from accessing the eDirectory 8.8 server. Refer to Section 8.4, “Preventing Legacy Novell Clients from... -
Page 48: How To Make Your Password Case-Sensitive
1 Log in to eDirectory using the existing password. In the case of fresh install, the existing password is the one that you set while configuring eDirectory 8.8. For example, your password is “novell”. NOTE: This password is not case-sensitive. 2 Enable Universal Password. -
Page 49: Managing Case-Sensitive Passwords
Administration utilities with eDirectory 8.8 Novell iManager 2.6 and later The clients and utilities that are earlier than the above mentioned versions are legacy Novell clients. You can have case-sensitive passwords for the legacy Novell clients after upgrading them to their latest versions. -
Page 50: Preventing Legacy Novell Clients From Accessing Edirectory 8.8 Server
Login session 3 and subsequent logins. If you log in using the password noVell, it is valid. If you log in using the password Novell (or any other version except noVell), it is invalid. 8.4 Preventing Legacy Novell Clients from Accessing eDirectory 8.8 Server... -
Page 51: Managing Nds Login Configurations
8.8 eDirectory 8.8 server. 8.4.2 Managing NDS Login Configurations By configuring the NDS login, you can allow or disallow the legacy Novell clients from accessing the eDirectory 8.8 server. You can manage NDS login configurations through Novell iManager 2.6 and LDAP. - Page 52 Enabling/Disabling NDS Configuration for a Partition To enable NDS login for pre-eDirectory 8.8 clients: 1 In Novell iManager, click the Roles and Tasks button 2 Select NMAS > Universal Password Enforcement. 3 In the Universal Password Enforcement plug-in, select NDS Configuration for a Partition.
- Page 53 Enabling/Disabling NDS Configuration for an Object To enable NDS login for pre-eDirectory 8.8 clients: 1 In Novell iManager, click the Roles and Tasks button 2 Select NMAS > Universal Password Enforcement. 3 In the wizard, select NDS Configuration for an Object.
-
Page 54: Partition Operations
NDAP password management is enabled irrespective of the configuration setting at the partition level. NOTE: For more information on creating and managing priority sync policies, refer to Using LDAP Tools on Linux, Solaris, or AIX (http://www.novell.com/documentation/edir88/) Novell Import Conversion Export Utility (http://www.novell.com/documentation/edir88/). -
Page 55: Enforcing Case-Sensitive Passwords In A Mixed Tree
However, the 8.7 server will not enforce the setting, so you can access the directory through the 8.7 server. 8.5 For More Information Refer to the following for more information on case-sensitive passwords: iManager online help Deploying Universal Password (http://www.novell.com/documentation/nmas23/admin/data/ allq21t.html) Enforcing Case-Sensitive Universal Passwords... - Page 56 Novell eDirectory 8.8 What's New Guide...
-
Page 57: Priority Sync
Priority Sync ® Priority Sync is a new feature in Novell eDirectory 8.8 that is complimentary to the current synchronization process in eDirectory. Through Priority Sync, you can synchronize the modified critical data, such as passwords, immediately. You can sync your critical data through Priority Sync when you cannot wait for normal synchronization. -
Page 58: Using Priority Sync
3. Apply the Priority Sync policies to the partitions through iManager. 9.3 For More Information Refer to the following for more information on Priority Sync: Novell eDirectory 8.8 Administration Guide (http://www.novell.com/documentation/edir88/ edir88/data/brp2di9.html#brp2z9z) iManager and iMonitor online help Novell eDirectory 8.8 What's New Guide... -
Page 59: Data Encryption
Data Encryption ® In Novell eDirectory 8.8 and later, you can encrypt specific data when they are stored on the disk and when they are transmitted between two or more eDirectory 8.8 servers. This provides greater security for the confidential data. -
Page 60: How To Encrypt Attributes
If you require encrypted replication between specific replicas of a partition that contain sensitive data. If you feel the network in your setup is hostile, you might want to protect sensitive data during replication. Novell eDirectory 8.8 What's New Guide... -
Page 61: Enabling Encrypted Replication
If you have made any changes to the certificates, like renaming them, encrypted replication fails. 10.3 For More Information Refer to the following for more information on encrypting data in eDirectory: Novell eDirectory 8.8 Administration Guide (http://www.novell.com/documentation/edir88/ index.html) iManager and iMonitor online help Data Encryption... - Page 62 Novell eDirectory 8.8 What's New Guide...
-
Page 63: Bulkload Performance
8.8 provides you with enhancements to increase bulkload performance. For information on increasing the bulkload performance, refer to the following sections of the Novell eDirectory 8.8 Administration Guide: eDirectory Cache Settings LBURP Transaction Size Setting Increasing the Number of Asynchronous Requests in ICE... - Page 64 Novell eDirectory 8.8 What's New Guide...
-
Page 65: Imanager Ice Plug-Ins
ICE Plug-ins ® Prior to Novell eDirectory 8.8, some of the Novell Import Conversion Export (ICE) utility command line options did not have corresponding options in the iManager plug-in. The following table lists the platforms that support this feature: Feature... -
Page 66: Add Schema From A Server
File For more information, refer to the Novell eDirectory Management Utilities (http://www.novell.com/ documentation/edir88/edir88/data/a5hf8rg.html#a5hf8rg) chapter in the Novell eDirectory 8.8 Administration Guide. 12.1.2 Add Schema from a Server The source and destination are LDAP servers. If you want to only compare the schema and not add the additional schema to the destination server, select the Do Not Add but Compare option. -
Page 67: Compare Schema Files
For more information, refer to the Novell eDirectory Management Utilities (http://www.novell.com/ documentation/edir88/edir88/data/a5hf8rg.html#a5hf8rg) chapter in the Novell eDirectory 8.8 Administration Guide. 12.2.2 Compare Schema between a Server and a File The Compare Schema between a Server and a File option compares the schema between a source server and a destination file and then places the result in an output file. - Page 68 Novell eDirectory 8.8 What's New Guide...
-
Page 69: Ldap-Based Backup
LDAP-Based Backup ® The LDAP-based backup feature is introduced with Novell eDirectory 8.8. This feature is used to backup the attributes and attribute values one object at a time. The following table lists the platforms that support this feature: Feature... - Page 70 Novell eDirectory 8.8 What's New Guide...
-
Page 71: Ldap Get Effective Privileges List
LDAP Get Effective Privileges List ® The LDAP Get effective privileges list API is introduced with Novell eDirectory 8.8 SP5. The following table lists the platforms that support this feature: Feature NetWare Linux UNIX Windows LDAP Get Effective Privileges List This feature can be used to obtain the effective privileges for a given subject DN on a given target DN for a given set of attributes. - Page 72 Novell eDirectory 8.8 What's New Guide...
-
Page 73: Managing Error Logging In Edirectory
Managing Error Logging in eDirectory 8.8 ® Many customers have reported that the error logging in Novell eDirectory does not help much in identifying and resolving the common problems. Error logging is automatically started during eDirectory installation. This chapter consists of the following sections: Section 15.1, “Message Severity Levels,”... -
Page 74: Error
Section 15.2.3, “NetWare,” on page 76 15.2.1 Linux and UNIX To configure the error logging settings for the server-side messages, you can use the n4u.server.log- levels and n4u.server.log-file parameters in the /etc/opt/novell/eDirectory/conf/nds.conf configuration file. Novell eDirectory 8.8 What's New Guide... -
Page 75: Windows
Setting the Severity Level The severity levels available are LogFatal, LogWarn, LogErr, LogInfo, and LogDbg levels (in decreasing order of severity). For more information on the severity levels, refer to Section 15.1, “Message Severity Levels,” on page By default, the severity level is set "LogFatal". So, only messages with severity level fatal will be logged. -
Page 76: Netware
“Message Severity Levels,” on page To set the severity level, do the following: 1 Click Start > Settings > Control Panel > Novell eDirectory Services 2 In the Services tab, select dhlog.dlm. 3 Enter the log level in the Startup Parameters box. - Page 77 NOTE: is automatically up when DS is up. However, you can manually unload/load DSLOG.NLM DSLOG.NLM The severity levels available are LogFatal, LogWarn, LogErr, LogInfo, and LogDbg levels (in decreasing order of severity). For more information on the severity levels, refer to Section 15.1, “Message Severity Levels,”...
-
Page 78: Dstrace Messages
1 Enable filtering with the following command: ndstrace tag filter_value To disable filtering, enter the following command: ndstrace tag Examples for enabling filtering: To enable filtering for thread ID 35, enter the following: ndstrace thrd 35 Novell eDirectory 8.8 What's New Guide... -
Page 79: Windows
Figure 15-1 15.3.2 Windows Complete the following procedure to filter the trace messages: 1 Select Start > Control Panel > Novell eDirectory Services 2 In the Services tab, select dstrace.dlm. 3 Click Edit > Options in the Trace window. The Novell eDirectory Trace Options dialog box is displayed. -
Page 80: Imonitor Message Filtering
You can filter the iMonitor trace messages based on the connection ID, thread ID, or error number. To filter based on the connection ID and thread ID, ensure that you have enabled them in the Trace Configuration tab. Novell eDirectory 8.8 What's New Guide... -
Page 81: Sal Message Filtering
For more information, refer to the iMonitor online help. 15.5 SAL Message Filtering SAL has been enhanced to log extensive information on errors on demand. Function calls can be traced with arguments in the debug builds. 15.5.1 Configuring the Severity Levels You can use the SAL_LogLevels parameter to configure the severity levels for the SAL messages. -
Page 82: Setting The Log File Path
Syslog: In Linux and UNIX, the messages will go to the syslog. On NetWare and Windows, messages are logged into a file with the name syslog. This is the default behavior for logging. All critical errors are always logged to syslog unless it is disabled specifically. Novell eDirectory 8.8 What's New Guide... -
Page 83: Offline Bulkload Utility: Ldif2Dib
Offline Bulkload Utility: ldif2dib ldif2dib is a new utility introduced with Novell eDirectory 8.8 for bulkloading data from LDIF files to the eDirectory database.This is an offline utility and achieves faster bulkloads compared to the other online tools. The following table lists the platforms for which ldif2dib is supported. - Page 84 Novell eDirectory 8.8 What's New Guide...
-
Page 85: Edirectory Backup With Sms
Target Service Agent (TSA) The TSA for the eDirectory (tsands) services eDirectory targets and provides an implementation of the Novell Storage Management Services API for the directory trees. Applications can be wriiten on top of to provide a complete backup solution. - Page 86 Novell eDirectory 8.8 What's New Guide...
-
Page 87: Ldap Auditing
Because LDAP is an important interface of eDirectory, to provide a mechanism for applications to ® audit eDirectory LDAP server, a new LDAP event subsystem is introduced in Novell eDirectory SP3 version. This subsystem generates LDAP specific events with all the relevant information for an application to audit an LDAP server. - Page 88 Novell eDirectory 8.8 What's New Guide...
-
Page 89: Miscellaneous
Miscellaneous ® This chapter covers miscellaneous new features with Novell eDirectory 8.8. Section 19.1, “Security Object Caching,” on page 89 Section 19.2, “Subtree Search Performance Improvement,” on page 89 Section 19.3, “Localhost Changes,” on page 90 Section 19.4, “256 File Handler on Solaris,” on page 90 Section 19.5, “Memory Manager on Solaris,”... -
Page 90: Localhost Changes
This feature is called Nested Groups. Currently, nesting is allowed for static groups. Nesting can have multiple levels upto 200. For more information on Nested Groups, refer to the Novell eDirectory 8.8 Administration Guide (http://www.novell.com/documentation/edir88/index.html) Novell eDirectory 8.8 What's New Guide...