Naming and Directory Services (DNS, NIS, and LDAP)

information will be searched for a given domain. This node is specified with thedefaultSearchBase attribute. Additionally, you might want to set thedefaultSearchScope attribute to tell the clients the scope of search a namingservice lookup should perform. Is it just searching one level under the DN (one), orthe entire subtree under the DN (sub)?There are times, however, that more flexibility is needed for the LDAP naming serviceto either work with an existing DIT or handle a more complicated DIT with namingservice data scattered around the directory tree. For example, user account entries mayexist in different part of the tree. The serviceSearchDescriptor, attributeMap,and objectclassMap attributes in the client profile are designed to handle thesesituations.A service search descriptor can be used to override the default search base, searchscope, and search filter for a particular service. See “Service Search Descriptors (SSDs)and Schema Mapping” on page 134.The AttributeMap and ObjectclassMap attributes provide a way for schemamapping. They make it possible for the LDAP naming services to work with anexisting DIT. You can map the posixAccount object class to an existing object class,myAccount, for example. You can map an attribute in the posixAccount object classto an attribute in the myAccount object class.Multiple Directory ServersMultiple LDAP servers can serve one DIT. For example, some subtrees of the DITreside on other LDAP servers. In this case, an LDAP server may refer the LDAP clientto a different server for the naming data it knows about but is not in its own database.If you plan such a DIT configuration, you should set the clients’ profile attributefollowReferrals to indicate to the LDAP naming service to follow server referralsto continue naming service lookups. However, it is best to have all naming data for agiven domain reside on a single directory server, if at all possible.Referrals can be useful if you want to have clients access read-only replicas most of thetime and follow referrals to a read/write master server only when necessary. In thisway, the master server does not get overloaded with requests that could be handled byreplicas.Data Sharing With Other ApplicationsTo make best use of LDAP, you should have a single LDAP entry for each logicalentry. For example, for a user you can have not only company white-page information,but also Solaris account information, and possibly application-specific data. SinceposixAccount and shadowAccount are auxiliary object classes, they can be addedto any entry in the directory. This will require careful planning, setup, andadministration.Chapter 10 • Planning Requirements for LDAP Naming Services (Tasks) 155