Jump to content United States-English
HP.com Home Products and Services Support and Drivers Solutions How to Buy
» Contact HP
More options
HP.com home
 Installing and Administering LDAP-UX Client Services with Microsoft Windows 2000 Active Directory > Chapter 3 About Active Directory Multiple Domain Support

Duplicate Entries
» 

Technical documentation

Complete book in PDF
» Feedback
Content starts here

 » Table of Contents

 » Glossary

 » Index

spacerspacerspacer
spacer
spacer
  		 
 

In the Windows 2000 environment, a user account can exist in multiple domains. Each account has a user principal name (UPN) in the format <user>@<DNS-domain-name>. Users can log on using UPN without choosing a domain. Due to the limitation of HP-UX operating system, LDAP-UX doesn't support UPN as in Windows 2000. It is recommended that you configure unique user name and uid number in the forest. When the same account exists in multiple domains, LDAP-UX uses the following rules to return information:

When there are duplicate entries in the local domain

LDAP-UX returns the first entry found.

When there are duplicate entries in remote domains

  • If the remote domains are configured: LDAP-UX follows the configuration sequence to search each domain and returns data from the first one found.

  • If only GCS is configured: LDAP-UX returns NOT_FOUND.

  • If both remote domains and the GCS are configured: LDAP-UX searches remote domains first, and returns the first one found. If no entry is found in the remote domains, and duplicate entries are in other domains in the forest, LDAP-UX returns NOT_FOUND.

When there are duplicate entries in both local and remote domains

LDAP-UX returns the first entry found in the local domain.

When LDAP-UX returns NOT_FOUND, the user will not be able to log into HP-UX clients. Therefore, if you want to allow a user in remote domains to log into HP-UX, it is better to have a unique user name and uid number for each user in the entire forest, otherwise, you need to make sure that your multiple domain configuration allows LDAP-UX to return data.

An Example

The following uses an example to explain what to expect when your user accounts are not unique in the forest.

Assume the user account jimmy resides in domainA, domainB, and domainC simultaneously:

  • If domain A is the local domain, jimmy in domainA will be the one logging into HP-UX client (i.e. the local one).

  • If all three domains are remote domains, and you configure to use remote domains in the sequence of (domainB, domainC, DomainA), then jimmy in DomainB will log into HP-UX client (i.e. the first one in remote domain configuration).

  • If all three domains are remote domains, and you choose GCS, then jimmy cannot log into HP-UX client at all since LDAP-UX can not distinguish which jimmy is the preferred one (i.e. duplicate entries for GCS, no one is valid).

  • If all three domains are remote domains, and you include DomainC in your remote domain configuration and you also choose the GCS, then jimmy in DomainC gets to log into HP-UX client (i.e. remote domain configuration overrides the GCS).

If the user name jimmy is unique in the forest, but the uid number is not unique, even though jimmy can log into the HP-UX machine, depending on if the uid number can be returned, he may have problems changing his password using the passwd command.



ldapux_client.conf
  		 


Multiple Domain Configuration Changes  
Printable version
Privacy statement Using this site means you accept its terms Feedback to webmaster
© 2002 Hewlett-Packard Development Company, L.P.