Jump to content United States-English
HP.com Home Products and Services Support and Drivers Solutions How to Buy
» Contact HP
More options
HP.com home
 LDAP-UX Client Services B.04.10 with Microsoft Windows Active Directory Administrator's Guide: HP-UX 11i v1 and v2 > Chapter 3 Active Directory Multiple Domains

Resolving Duplicate Entries
» 

Technical documentation

Complete book in PDF
» Feedback
Content starts here

 » Table of Contents

 » Glossary

 » Index

spacerspacerspacer
spacer
spacer
  		 
 

In the Windows 2000 or 2003 environment, a user account can exist in multiple domains. Each account has a user principal name (UPN) in the format <user>@<DNS-domain-name>. Users can log on using UPN without choosing a domain. Due to the limitation of the HP-UX operating system, LDAP-UX does not support UPN as in Windows 2000 or 2003. It is recommended that you configure a unique user name and uid number in the forest. When the same account exists in multiple domains, LDAP-UX uses the following rules to return information:

When there are duplicate entries in the local domain

LDAP-UX returns the first entry found.

When there are duplicate entries in remote domains

  • If the remote domains are configured, LDAP-UX searches each domain in the configuration sequence and returns data from the first entry found.

  • If only GCS is configured, LDAP-UX returns a NOT_FOUND message.

  • If both remote domains and GCS are configured, LDAP-UX searches remote domains first, and returns the first entry found. If no entry is found in the remote domains, and duplicate entries are in other domains in the forest, LDAP-UX returns a NOT_FOUND message.

When there are duplicate entries in both local and remote Domains

LDAP-UX returns the first entry found in the local domain.

When LDAP-UX returns a NOT_FOUNDmessage, the user cannot log into HP-UX clients. Therefore, if you want to allow a user in remote domains to log into HP-UX, it is better to have a unique user name and uid number for each user in the entire forest. Otherwise, be sure that your multiple domain configuration allows LDAP-UX to return data.

Example

The following example explains what to expect when your user accounts are not unique in the forest.

Assume the user account jimmy resides in domainA, domainB, and domainC simultaneously:

  • If domain A is the local domain, jimmy in domainA will log into HP-UX client.

  • If all three domains are remote domains, and are configured in the sequence: domainB, domainC, domainA, then jimmy in domainB, the first domain in the configuration, will log into HP-UX client.

  • If all three domains are remote domains, and the GCS is selected, then jimmy cannot log into HP-UX client at all since LDAP-UX cannot distinguish which jimmy is preferred (when duplicate entries exist for GCS, none is valid).

  • If all three domains are remote domains, domainC is included in your remote domain configuration, and GCS is selected, then jimmy in domainC logs into HP-UX client.

If the user name jimmy is unique in the forest, but the uid number is not unique, jimmy can log into the HP-UX client, but depending on if the uid number can be returned, he may have problems changing his password using the passwd command.



Understanding the ldapux_client.conf Configuration File
  		 


Changing Multiple Domain Configurations  
Printable version
Privacy statement Using this site means you accept its terms Feedback to webmaster
© 2006 Hewlett-Packard Development Company, L.P.