Netscape DIRECTORY SERVER 6.01 - ADMINISTRATOR Administrator's Manual page 101

The database link on server A binds to server B using a special user as defined in
the
nsMultiplexorBindDN
nsMultiplexorCredentials
following bind credentials:
nsMultiplexorBindDN: cn=proxy admin,cn=config
nsMultiplexorCredentials: secret
Server B must contain a user entry corresponding to the
and you must set the proxy authentication rights for this user. To set the proxy
authorization right, you need to set the "proxy" ACI as you would any other ACI.
Carefully examine access controls when enabling chaining to avoid
CAUTION
giving access to restricted areas of your directory. For example, if
you create a default proxy ACI on a branch, the users that connect
via the database link will be able to see all entries below the branch.
There may be cases when you do not want all of the subtrees to be
viewed by a user. To avoid a security hole, you may need to create
an additional ACI to restrict access to the subtree.
For more information on ACIs, refer to "Managing Access Control," on page 187.
For more information about the proxy authentication control, refer to the C-SDK
documentation at
http://enterprise.netscape.com/docs
NOTE When a database link is used by a client application to create or
modify entries, the attributes
do not reflect the real creator or modifier of the entries. These
attributes contain the name of the administrative user granted
proxied authorization rights on the remote data server.
attribute and a user password as defined in the
attribute. In this example, server A uses the
creatorsName
Chapter 3
Creating and Maintaining Database Links
nsMultiplexorBindDN
.
and
modifiersName
Configuring Directory Databases
,
101