Naming and Directory Services (DNS, NIS, and LDAP)

eplica. For example, assume that the NIS+ directory dir1 contains the tables table1and table2. When the replica is obtaining data for both table1 and table2 fromthe NIS+ master, you might see an output like the following.# nisping dir1Master server is "master.some.domain."Last update occurred at Mon Aug 5 22:11:09 2002Replica server is "replica.some.domain."Last Update seen was Mon Aug 5 22:11:09 2002The above indicates that the master and replica have exactly the same data. However,if the replica is getting data for either or both of table1 and table2 from LDAP, theoutput only shows that the replica has received an NIS_PING from the master, andupdated its resynchronization time stamp for housekeeping purposes. The data in thetable or tables mapped from LDAP might differ from that on the NIS+ master if eitherof the following are true.■■The LDAP data differs from that on the NIS+ master.The replica has data in its cache (its local version of the NIS+ database) that has notexpired, but that is not up to date with LDAP.If you cannot accept this type of data inconsistency, let all NIS+ replicas obtain theirdata from the NIS+ master only. Once you have configured the NIS+ master to getdata from LDAP, you do not need to make modifications to the replicas.The Directory Server (NIS+ to LDAP)The LDAP mapping portion of the rpc.nisd daemon uses LDAP protocol version 3to talk to the LDAP server. The default mapping configuration(/var/nis/NIS+LDAPmapping.template) expects that the LDAP server supportsan extended version of RFC 2307. RFCs can be retrieved fromhttp://www.ietf.org/rfc.html. While the mapping between NIS+ and LDAPdata can be modified using NIS+LDAPmapping(4), there is a basic assumption thatthe LDAP data is organized along the principles laid out in RFC 2307.For example, in order to share account information between direct LDAP clients andNIS+ clients, the LDAP server must support storing account (user) passwords in theUNIX crypt format. If the LDAP server cannot be configured to do so, you can stillstore NIS+ data, including accounts, in LDAP. However, you will not be able to fullyshare account information between NIS+ users and LDAP bindDNs.Chapter 16 • Transitioning From NIS+ to LDAP 269