Techniques for maintaining NDS® and Novell eDirectory™-
An Administrators How-to Guide

Gary J Porter

Worldwide Training — IDM2/eDirectory

Novell, Inc.

Kent Gassman

Worldwide Training — eDirectory

Novell, Inc.

Agenda

Theory and Concept Review

Solving common problems

Inconsistencies

Communications

Replica Rings

Obituaries

Schema Issues

eDirectory Concepts

Schema

Distributed namespace domains

Root object

Replicas

Replica types and their duties

Referential integrity

Life of an object

Moving/renaming/deleting

Event Ordering (time synchronization)

Schema

One point of view: A recipe for building objects

Another point of view: A book of laws for the directory

Effective / Non-effective / Auxiliary

Effective Class

Super Classes:	(none)

Containment:	(none)

Named by:	(none)

Mandatory:	Object Class

Optional:	ACL	Certficate Revocation	Referenced Time

Authority Revocation	Certificate Validity	Obituary

Back Link	Interval	Other GUID

Bindery Property	Cross Certificate Pair	Reference

CA Private Key	Equivalent To Me	Revision

CA Public Key	GUID	Used By

Super Classes:	Top

Containment:	Top

Tree Root

(Nothing)

Named by:	C

Mandatory:	C

Optional:	Description

Super Classes:	Top

Containment:	Organization

Organizational Unit

Named by:	CN

Mandatory:	CN

Optional:	Description

L

Network Address

O

OU

Owner

See Also

Serial Number

Effective Class

Super Classes:	Device

Containment:	(none)

Named by:	(none)

Mandatory:	(none)

Optional:	Operator

Server

Status

Effective Class

Super Classes:	Device

Containment:	(none)

Named by:	(none)

Mandatory:	Object Class

Optional:	Cartridge	Default Queue	Host Device

Memory	Network Address Restriction	Notify

Operator	Page Description Language	Print Server

Printer Configuration	Queue	Status

Supported Typefaces

TOP

Country

Device

Computer

Printer

Schema Inheritance

Effective Class

Super Classes:	(none)

Containment:	(none)

Named by:	(none)

Mandatory:	Object Class

Optional:	ACL	Certficate Revocation	Referenced Time

Authority Revocation	Certificate Validity	Obituary

Back Link	Interval	Other GUID

Bindery Property	Cross Certificate Pair	Reference

CA Private Key	Equivalent To Me	Revision

CA Public Key	GUID	Used By

Super Classes:	Top

Containment:	Top

Tree Root

(Nothing)

Named by:	C

Mandatory:	C

Optional:	Description

Super Classes:	Top

Containment:	Organization

Organizational Unit

Named by:	CN

Mandatory:	CN

Optional:	Description

L

Network Address

O

OU

Owner

See Also

Serial Number

Effective Class

Super Classes:	Device

Containment:	(none)

Named by:	(none)

Mandatory:	(none)

Optional:	Operator

Server

Status

Effective Class

Super Classes:	Device

Containment:	(none)

Named by:	(none)

Mandatory:	Object Class

Optional:	Cartridge	Default Queue	Host Device

Memory	Network Address Restriction	Notify

Operator	Page Description Language	Print Server

Printer Configuration	Queue	Status

Supported Typefaces

TOP

Country

Device

Computer

Printer

Effective

Non-Effective

myAuxilaryClass

Mandatory properties

Schema defines which attributes of an object are mandatory and which are optional

When an object is missing one of its mandatory attributes a -609 error is generated

Question: How many mandatory attributes does an eDirectory User have?

Name them!

Missing Mandatory

How do we fix missing mandatory attributes?

Delete and recreate the object

Supply the missing information

Mutate the object

Missing Mandatory Demo

Consistant DIBs and Replica Rings

Partitions—namespace domains

Two types (system-user defined)

Replica types

Replica states

All driven by synchronization

Master Replica

Master replica governs partition operations

move, add replica, delete replica, splitting a replica, merging back into the parent

Master is also responsible for processing obituaries

The master replica, along with its ring members, define the root namespace of each partition

Typical errors for Master/Secondary: -672, -673, -634

Secondary - Read-write

A read-write replica is a master nearly all the time

Provides redundant copies of namespaces

Can be promoted to Master

Allows direct editing of namespace objects

Typical errors for Master/Secondary: -672, -673, -634

Subordinate Replica

Subordinate Reference is just a reference used to provide directions to “real replicas”.

Placed on a server (and therefore in a ring) when a server is holding a partition that has a child but the child isn't stored on that same server.

The sub-ref provides a method for the server to always be able to point to the child partition if asked (remember parents always keep up with their children)

Typical errors for Sub-refs: -667

Replica Ring Demo 1

Replica Ring Demo 2

Obituaries

Why Obituaries?

Bottom line—servers don't swap object Ids!

Objects must be referenced by their naming attribute

Therefore... renaming, moving or deleting objects MUST be coordinated between servers

How do you know if you have any?

What does it hurt if I DO have some?

What IS an obit—really?!

Obituaries

An obituary is an attribute, period!

Added to an object that is about to experience a radical change (move, rename or delete)

Obits are referred to in terms of flags and types

The type describes what is happening (rename, move, tree rename, delete, etc.)

Flags determine the current state of the obit (0000, or 0001, or 0010, or 0100)

Obituaries

Finding obits

iMonitor

DSBrowse

DSRepair

Obits that never process indicate a problem – downed server, mismatched replica rings, inconsistent databases, bad com link, etc.

Typical Obituary errors: -606, -637 repetitive replica sync

Obituary Demo

Back to Schema

How do you tell the difference between operational schema and a schema extension?

Demo (finding operational schema)...

Typical schema errors: -604, -608,

Schema Issue Demo

For More Information

Don't miss:

TUT249 - Troubleshooting Novell eDirectory

TUT280 - Deploying Novell eDirectory on Linux

TUT281 - Novell eDirectory Tips and Tricks

DL 255 - eDirectory Security with LDAP Access Control and Configuration

2005-01-27T14:30:00