Naming and Directory Services (DNS, NIS, and LDAP)

Carefully consider how critical it is to have NIS+ data in close synchronization withLDAP, and select the longest TTL that is acceptable for each NIS+ object. The default(when no nisplusLDAPentryTtl is specified) is 1 hour. The template mapping file/var/nis/NIS+LDAPmapping.template changes this to 12 hours for objects otherthan table entries. However, there is no auto-recognition of non-entry objects, so if youadd mapping for a non-entry object, the TTL will default to 1 hour.Note – There are no TTLs for nonexistent objects. Hence, no matter which TTLs are ineffect for LDAP-mapped entries in an NIS+ table, a request for an entry that does notexist in NIS+ will query LDAP for that entry.nisplusLDAPobjectDNnisplusLDAPobjectDN AttributeFor each mapped NIS+ object, nisplusLDAPobjectDN establishes the location in theLDAP DIT where the object data resides. It also allows specification of the action totake when an LDAP entry is deleted. Each nisplusLDAPobjectDN value has threeparts. The first specifies where LDAP data is read from, the second to where it iswritten, and the third what should happen when LDAP data is deleted. Refer to thefollowing example.rpc_table:\cn=rpc,ou=nisPlus,?base?\objectClass=nisplusObjectContainer:\cn=rpc,ou=nisPlus,?base?\objectClass=nisplusObjectContainer,\objectClass=topThe above example shows that the rpc.org_dir table object should be read from theDN cn=rpc,ou=nisPlus, (since the value ends in a comma, the value of thedefaultSearchBase attribute is appended), with scope base, and that entries witha value of nisplusObjectContainer for the ObjectClass attribute are selected.The table object is written to the same place. The delete specification is missing, whichimplies the default action, which is as follows. If the NIS+ table object is deleted, theentire LDAP entry should also be deleted.If data should be read from, but not written to LDAP, omit the write portion (and thecolon separating it from the read part).nisplusLDAPobjectDNrpc_table:\cn=rpc,ou=nisPlus,?base?\objectClass=nisplusObjectContainerNote that the nisplusObjectContainer object class is not part of RFC 2307. Inorder to use it, you must configure your LDAP server as detailed in “Mapping NIS+Objects Other Than Table Entries” on page 273.For the rpc.org_dir table entries, you could use the following example.Chapter 16 • Transitioning From NIS+ to LDAP 261