Frequently Asked Questions

Where to Install

Where do I install the SecretStore service?

Install Novell^® SecretStore^® on a server that has a read/write replica.

Setting Up a Tree Key

How do I set up a tree key for eDirectory?

If you are running Novell eDirectory^TM 8.5 or later, the tree key is already set up. NetWare^® 5.1, later NetWare versions, and the Novell Certificate Server^TM automatically set up the tree key.

If you are running NDS^® or a version of eDirectory earlier than 8.5, download and install the latest Novell Certificate Server, which is available from the Novell Product Downloads Web site.

Reading Preferences

Why doesn't SecretStore read preferences set up one level from the user?

Users require Read/Compare ACL to the Prot:SSO attributes on the OUs that they will read.

Scenario: User Markus is in OU=RSDev.design.digitalairlines. The corporate scripts are in OU=design.digitalairlines. The SecureLogin client does not enforce (for Markus) preferences in design.digitalairlines. You require Read/Compare ACL to the Prot:LSSO attributes on the RSDev OU. The SecureLogin client now enforces the preferences.

Merging Trees

If SecretStore is running in separate trees, can I merge the trees without any hit to SecretStore?

No. After the merge, only SecretStore data in the destination tree will be valid. Before merging, delete SecretStore data from the source tree. After authenticating to the new tree, you must resave your single sign-on data.

See Merging Novell eDirectory Trees in the Novell eDirectory 8.7 Administration Guide.

"Not Available" Displays for Last Admin Unlock TimeStamp

Why does Not Available display at the GetServiceInfo screen in SecretStore Manager? The SecretStore Information screen displays "Not Available" for the Last Admin Unlock Timestamp setting.

Most likely, no SecretStore administrator has ever unlocked the user's SecretStore. SecretStore Manager has nothing to report.

SecretStore Manager can't display any information for the following situations:

• No one has been added to the SecretStore Administrator List in ConsoleOne. See Setting Up a SecretStore Administrator .
• Although someone has been added to the SecretStore Administrator List, the network administrator disabled SecretStore Administrator access to SecretStore before SecretStore was locked.

  If someone unlocks a user's SecretStore and then disables SecretStore Administrator access to SecretStore, SecretStore Manager nevertheless reports the timestamp and distinguished name of whoever unlocked the SecretStore.

• Although a SecretStore has been locked, no one has unlocked it.