Novell EDIRECTORY 8.8 - GUIDE, Manual

Page: 542 / 574

NMAS Considerations
A
no
vd
ocx (
E
NU)
01
F
ebr
ua
ry
200
6
543
A
NMAS Considerations
This appendix contains the following topics:
• Section A.1, “Setting Up a Security Container As a Separate Partition,” on page 543
• Section A.2, “Merging Trees with Multiple Security Containers,” on page 543
A.1 Setting Up a Security Container As a
Separate Partition
Novell
®
Modular Authentication Services (NMAS
TM
) relies on the storage of policies that are global
to the Novell eDirectory
TM
tree. The eDirectory tree is effectively the security domain. The security
policies must be available to all servers in the tree.
NMAS places the authentication policies and login method configuration data in the Security
container that is created off of the [Root] in NetWare
®
5.1 or later eDirectory trees. This information
must be readily accessible to all servers that are enabled for NMAS. The purpose of the Security
container is to hold global policies that relate to security properties such as login, authentication, and
key management.
With NMAS, we recommend that you create the Security container as a separate partition, and that
the container be widely replicated. This partition should be replicated as a Read/Write partition only
on those servers in your tree that are highly trusted.
NOTE: Because the Security container contains global policies, be careful where writable replicas
are placed, because these servers can modify the overall security policies specified in the eDirectory
tree. In order for users to log in with NMAS, replicas of the User objects must be on the NMAS
server.
A.2 Merging Trees with Multiple Security
Containers
Special considerations need to be made when merging eDirectory trees where a Security container
has been installed in one or both of the trees. Make sure that this is something you really want to do
because this procedure has the potential to be a very time-consuming and laborious task.
IMPORTANT: These instructions are complete for trees with Novell Certificate Server
TM
2.21 and
earlier, Novell Single Sign-on 2. x , and NMAS 2. x .
To merge trees with multiple Security containers:
1 In iManager, identify the trees that will be merged.
2
Identify which tree will be the source tree and which tree will be the target tree.
Keep in mind these security considerations for the source and target trees:
• Any certificates signed by the source tree's Organizational CA must be deleted.
• The source tree's Organizational CA must be deleted.