Extending the eDirectory Schema

So that SecureLogin can save users' single sign-on information, the Novell^® eDirectory^TM schema must be extended. Ndsschema.exe extends the eDirectory schema and grants rights to existing users so that they can use SecureLogin.

The SecureLogin snap-in to ConsoleOne^® automatically grants rights to objects that you create after you run ndsschema.exe. Therefore, you don't need to run ndsschema.exe again. You only extend the eDirectory tree schema once for SecureLogin.

IMPORTANT:  If you create objects by using ConsoleOne on a workstation that doesn't have the SecureLogin snap-in, those objects won't receive rights.

To extend the schema of a given tree, you must have sufficient rights over the [root] of the tree.

IMPORTANT:  Don't run ndsschema.exe from a Windows 98 workstation. SecureLogin doesn't support doing this.

1. At the \securelogin\tools directory, run ndsschema.exe.

   The extension might take some time to filter throughout your network, depending on the size of your network and the speed of the links.

   When the NDS^® or eDirectory schema is extended, the following attributes are added:

   • Prot:SSO Auth
   • Prot:SSO Entry
   • Prot:SSO Entry Checksum
   • Prot:SSO Profile
   • Prot:SSO Security Prefs
   • Prot:SSO Security Prefs Checksum

   For information on these attributes, see Extending the Active Directory Schema.

2. Specify an eDirectory context so that SecureLogin can assign rights to User objects.

   You will be prompted to define a context where you want the User objects' rights to be updated, allowing users access to their own single sign-on credentials. The following figure illustrates this prompt:

   
   

   If you don't specify a context, rights begin at the root of the eDirectory tree.

   Rights on Container objects are inherited. These rights flow to subdirectories, so that users can read attributes. User rights aren't inherited.

   If the installation program displays a message similar to -601 No Such Attribute, you have probably entered an incorrect context or included a leading dot in the context.

3. (Conditional) Grant rights to local cache directories.

   Users on Windows NT, Windows 2000, and Windows XP must have workstation rights to their local cache directory locations. To grant rights, do one of the following:

   • Grant rights to the user's cache directory (for example, c:\program files\novell\securelogin\cache\v2slc\username)

     The default location is the user's profile directory. By default, the user already has rights to this directory. However, if the user specified an alternative path during the installation, you might need to grant rights to the cache directory.

   • During the installation, specify a path to a location that the user has rights to (for example, the user's documents folder).