Netscape NETSCAPE DIRECTORY SERVER 6.1 - ADMINISTRATOR, Administrator'S Manual

Page: 116 / 578

Creating and Maintaining Database Links
116 Netscape Directory Server Administrator’s Guide • August 2002
• ACIs that refer to values of a user’s entry (for example,
userattr
subject rules)
will work if the users is remote.
Though access controls are always evaluated on the remote server, you can also
choose to have them evaluated on both the server containing the database link and
the remote server. This poses several limitations:
• During access control evaluation, contents of user entries are not necessarily
available (for example, if the access control is evaluated on the server
containing the database link and the entry is located on a remote server).
For performance reasons, clients cannot do remote inquiries and evaluate
access controls.
• The database link does not necessarily have access to the entries being
modified by the client application.
When performing a modify operation, the database link does not have access
to the full entry stored on the remote server. If performing a delete operation,
the database link is only aware of the entry’s DN. If an access control specifies a
particular attribute, then a delete operation will fail when being conducted
through a database link.
Advanced Feature: Tuning Database Link
Performance
The following sections provide information on tuning the performance of your
database links through connection and thread management. It contains the
following parts:
• Managing Connections to the Remote Server
• Detecting Errors During Normal Processing
• Managing Threaded Operations
NOTE By default, access controls set on the server containing the database
link are not evaluated. To override this default, use the
nsCheckLocalACI
attribute in the
cn=
database_link_name
,cn=chaining
database,cn=plugins,cn=config
entry. However, evaluating
access controls on the server containing the database link is not
recommended unless using cascading chaining.