User and group management

he Netscape® administration server lets you manage the users and groups that access the services provided by your Netscape servers. Because you manage users and groups from the administration server, you use the same interface for user and group management regardless of the type of servers or the number of servers that you are running at your site. This common management scheme provides simplified server administration by letting you maintain a single directory of users for all your Netscape servers.

This chapter contains basic information about the differences between using a local database, an LDAP directory service, and Novell® Directory Services.

Note

The directory service

You have a choice of the type of directory service you can use with your administration server: You can use a local directory, a Netscape Directory Server LDAP, or Novell Directory Services, which is a new option available for the Novell administration server. When configured to use Novell Directory Services, users and groups are maintained by NetWare® administration utilities. Thus the Users & Groups area of the administration server is disabled. However, in this mode, all access control comes from NetWare file system trustees rights and available Novell Directory Services usernames and passwords for http authentication.

The local directory

The local directory has the following limitations when compared to the Netscape Directory Server LDAP:

• The local directory cannot communicate across the network. It does not use the LDAP protocol. This means your users cannot use an LDAP client to perform directory access. They can, however, access the information through the administration server.
  
• The local directory supports no more than 1,000 entries.
  
• The local directory is slower on lookups than the directory server because the local directory does not cache entries.
  
• The local directory does not perform schema checking. This means that the directory will not stop you from using object classes and attributes that are unknown to it.
  
• The local directory does not perform any kind of access control checking; however, you can configure access to the directory using the administration server.
  
• The local directory cannot be replicated.
  

Netscape Directory Server

The use of a directory server to manage your servers' users and groups is recommended for large organizations consisting of up to one million users. Directory server is also ideal for organizations spread across physically different locations and for organizations where balancing the access load to their directory is important. Finally, the directory server is recommended for those organizations interested in enhancing directory availability by placing their directory services on multiple servers.

For more information about the directory server or about directory services in general, see the Administrator's Guide, which comes with the Netscape Directory Server.

Novell Directory Services

HTTP access to a file or resource in Novell Directory Services mode is evaluated using NetWare file system trustee assignments depending on the http method used. Table 6.1 defines the NetWare file system trustees required to grant access to web resources in Novell Directory Services mode given an http method.

HTTP METHOD	NetWare trustee assignment required for access
GET	Read
PUT	Create on parent directory if file is being created or Write if file is being replaced
MKDIR	Create
EDIT	Write
HEAD	File Scan
DELETE	Erase
POST	Read on the CGI executable file
INDEX	File Scan
MOVE	Erase and Read on source, Create on destination
COPY	Read on source, Create on destination

When Novell Directory Services mode is selected,

• use the Novell administration utilities to maintain user and group information
  
• users will be required to login from the web browser to gain access to any web resources
  
• make sure SSL is enabled if you do not want Novell Directory Services passwords passed over the wire in the clear
  
• the administration server's Users & Groups area is disabled
  
• NetWare file system trustees assignments are available exclusively to control access to web resources
  
• Enterprise and FastTrack administration server's Restrict Access area is disabled
  
• none of the ldap command line utilities work natively with Novell Directory Services
  
• Enterprise and FastTrack access control lists (ACLs) are disabled.
  

Gateways

When you first install your administration server, you must configure your server to communicate either with the local directory or with the directory server. If you use a directory server, you need to make sure it has at least one user account that the administration server can access. This is usually the administration server superuser account. Beyond that, you'll experience no difference when using the Users & Groups forms.

For more information on how to use the Users & Groups forms, see the online documentation that is available with your administration server.

Command-line clients

The local directory provides two tools for your use: ldapmodify and ldapsearch. These are actually identical to the ldapmodify and ldapsearch command-line tools shipped with the directory server, except that the -C option has been added so that they can work with the local directory. Netscape Directory Server provides many command-line tools to help you administer and maintain your directory. NetWare Administrator provides the Novell Directory Services to maintain the directory. The NetWare Administrator and Rights.wxe maintain file system trustees.

For more information on the ldapmodify and ldapsearch command-line tools bundled with your administration server, see the online documentation. For more information on the command-line tools bundled with the directory server, see the Administrator's Guide.

Authenticating users to directory services

Authentication allows a directory service to know if you have sufficient permissions to perform operations in the directory. Examples of directory operations are

• searching the directory
  
• adding entries (such as users and groups) to the directory
  
• deleting entries from the directory
  
• modifying entries in the directory.
  

When you login to the administration server, the username and password that you provide are automatically used by the Users & Groups forms when they communicate with a directory server.

Note

Distinguished names

Traditionally, a DN consists of the following items, in this order:

• common name or a user ID
  
• list of regional or organizational attributes
  
• country designation.
  

Distinguished name syntax

cn=common name, street=address, l=locality, st=state or province, 
ou=organizational unit, o=organization, c=country name

For more information on object classes and attributes, and your directory server's schema, see Appendix A of the online documentation.

Generally, however, a DN begins with a specific common name and gives increasingly broader areas of identification, ending with the country name. However, the DN attributes you use and the order in which you organize them is up to you. The only requirement is that DN attributes must be separated by a comma and can optionally use a space following the separator.

Using uid-based distinguished names

<server_root>/admin-serv/config/dsgw-orgperson.conf

Distinguished name usage

cn=Ralph Swenson, ou=Accounting, o=Ace Industry, c=US 

cn=Ralph Swenson, o=Ace Industry, ou=Accounting, c=US

	cn=name, ou=Marketing, o=Ace Industry, c=US

	o=Ace Industry, c=US

	ou=Marketing, o=Ace Industry, c=US

For more information on your directory's organization, see "Planning your directory structure."

Distinguished name examples

The following are some examples of distinguished names:

cn=Wally Henderson,ou=Product Development,o=Bait and Tackle Inc, 
st=Minnesota,c=US

cn=Ashley Sweeny, ou=Product Test, o=Bait and Tackle Inc, st=Michigan, 
c=US

The various standard attributes that comprise a DN are

Attribute	Name	Definition
c	country	Identifies the name of the country under which the entry resides. Must be the two-letter country code, for example, c=US c=GB
cn	common name	Identifies the person or object defined by the entry, for example, cn=Wally Henderson cn=Database Administrators cn=printer3b
uid	user ID	Identifies the person or object defined by the entry. DNs based on uids are often preferred over cn-based DNs because they avoid duplicated distinguished names caused by people who share the same name.
l	locality	Identifies the locality in which the entry resides. The locality could be a city, county, township, or other geographic region, for example, l=Tucson l=Pacific Northwest l=Anoka County
o	organization	Identifies the organization in which the entry resides, for example, o=Netscape Communications Corp o=Public Power & Gas
ou	organizational unit	Identifies a unit within the organization, for example, ou=Sales ou=Manufacturing
st	state or province name	Identifies the state or province in which the entry resides, for example, st=Iowa st=British Columbia
street	street address	Identifies the street address at which the entry resides, for example, street=494 Rice Creek Terrace

in the following table:

Using commas in distinguished names

	o="Ace Industry, Corp", c=US

Notice that there are several branch points in the tree below the root. These branch points usually represent major organizational units within the larger organization. For example, if you work at a corporation, then your company is probably subdivided into organizations, such as marketing, sales, product development, and so forth. Each of these organizations may themselves contain further subdivisions, such as product development for Widget 1, product development for Widget 2, and so forth. An organizational unit, then, is a large, relatively static division or unit within your organization.

For information on how to create branch points in your directory, see "Creating organizational units" in the administration server online documentation.

The following sections discuss the pros and cons of creating subdivisions within your directory.

Disadvantages of organizational units

• Moving directory entries from one organizational unit to another involves deleting the entry from the original organizational unit and recreating it under the new organizational unit.
  
• To delete or rename organizational units, you must delete every entry from beneath the organizational unit, rename or delete the unit, and then recreate all of the deleted entries in another part of the directory tree. Because this task is tedious, you should be careful about creating organizational units in your directory tree if your company tends to frequently reorganize.
  

Advantages of organizational units

• If you are using replication, then you can manage subtrees on servers local to the organizations that they represent. This allows for local control of organizational information.
  
• You can also replicate specific subtrees to other directory servers. If you have certain entries that you want other organizations to view and other entries that you want to remain private, then you can easily provide access to the public entries by replicating them to a public directory server. This strategy is especially useful if you want to make some information available outside of a firewall, while making other information available only inside the firewall.
  
• Even if replication is not in use, you can easily restrict or allow access to entries representative of an organization if they are logically organized together in the directory tree.
  

Recommendations for using organizational units

• Use a directory structure that is subdivided along the lines of the major functional activities in your organization. These subdivisions can represent actual division names but refrain from using these names if your organization tends to frequently reorganize.
  
• If you work for an organization that frequently reorganizes or if your organization is young and still growing, then use generic names to represent major activities. For example, if your company has the following organizations:
  
  • Product Marketing for Widget 1
  • Product Marketing for Widget 2
  • Product Development and Documentation for Widget 1
  • Product Development and Documentation for Widget 2
  • Product Sales--East Coast
  • Product Sales--West Coast
  • Product Sales--Europe
  • Product Sales--Pacific Rim
  then try to use generic divisions within your directory:
  • Marketing
  • Development
  • Sales.
  Doing this will make it easier to manage your directory as new products are announced and as people transfer from one area to another, for example, from Product Sales--East Coast to Product Sales--West Coast.

• Consider geographic divisions as an alternative to organizational divisions, especially if your organization has major geographic points of activity. For example, if you have business offices in several cities, consider branch points based on the city names. Just because the gateway labels branch points as "organizational units" does not mean that your branch points must correspond to organizational units.
  
• Try not to divide your directory down to the smallest business unit or department name. This detailed level of division creates maintenance difficulties. For the same reason, try to avoid branching your directory to more than two or three levels deep.
  

Using the local directory

1. Under General Administration, click Global Settings | Configure Directory Service.
   
2. Select Local Database.
   
3. A dialog box appears to warn you that you will lose your directory service configuration information. Click OK.
   
4. In the Base DN field, type the distinguished name that will be used as a suffix for your local directory and also as the point from which directory lookups will occur by default.
   An example of a suffix that you could enter here is

   o=your company name, c=US

   If you do not enter a value in this field, then your suffix will be a null string, and all searches will begin from the top or root point of the directory.

5. Click Save Changes.
   

Using Netscape Directory Server LDAP

1. Under General Administration, click Global Setting | Configure Directory Service.
   
2. Click LDAP Directory Server.
   
3. A dialog box appears to confirm that you want to use a Directory Server. Click OK.
   
4. In the Host Name field, type the host name where the directory server is running. You must enter a host name even if the directory server is running on the local machine.
   
5. In the Port field, type the default number if your directory server is using a different port number than the default port number 389. If you are going to use SSL communications with a directory server, then you should enter the port number that the directory server is using for SSL communications. By default, this is port number 636.
   For information on SSL, see the Netscape Directory Server Administrator's Guide.

6. In the Base DN field, type the distinguished name that will be the point from which directory lookups will occur by default and will be the location where all the administration server's entries will be placed in your directory tree.
   An example of a base DN that you could enter here is

   o=your company name, c=US

   For more information on distinguished names, LDAP searches, and base DNs, see the Administrator's Guide.

7. In the Bind DN field, type the Bind DN that the administration server will use to initially bind (or login) to the directory server. This bind DN only requires read and search access to the directory. Because this DN and associated password (if any) is easily compromised, it is best to simply leave this field blank and then set up your directory server to allow anonymous search access. If you do not want to allow anonymous search access to your directory, then specify a bind DN entry here that only has read and search access to your directory. Do not specify your directory server's unrestricted user (Root DN) in this field.
   

Note

For more information on how the administration server binds to the directory server, see "Logging in to the administration server". For information on granting permissions to a directory server entry, see the Administrator's Guide.

1. In the Bind Password field, type the password for the Bind DN entry, if you have entered a bind DN in the previous field.
   
2. Click Save Changes. The changes take effect immediately.
   

Note

Using Novell Directory Services

1. Under General Administration, click Global Settings | Configure Directory Service.
   
2. Select Novell Directory Services.
   
3. A dialog box appears to confirm that you want to use Novell Directory Services. Click OK.
   
4. A Novell Directory Services treename will be displayed that represents the tree used by the server on which the admin server is hosted.
   
5. The Search Content List box allows an administrator to specify multiple Novell Directory Services contexts in which to search for users during authentication. This allows users to specify a relative distinguished name, much like a uid for LDAP directories that provide a noncontextual type login. The user search will start at the first context and continue until the relative name provided by the user is found.
   
6. Click Insert Context to add a new search context.
   
7. Click Remove Context to remove one or more search contexts.
   
8. Click Float Context to move the selected context to a higher priority context.
   
9. Click Save Changes.
   

If you change directory service from a local or remote LDAP directory to Novell Directory Services, you need to restart all Netscape servers. The administration server does not need to be restarted because its configuration is dynamically updated to refer to the Novell Directory Services operation mode.

Note