Novell EDIRECTORY 8.8 SP3, Administration Manual, Page: 245 / 634

Encrypting Data In eDirectory 245
n
ov
do
cx (e
n)
11
Ju
ly 20
08
Recommendation: eDirectory stores several attributes for its own operations which should not be
marked for encryption. If these attributes are marked for encryption, some of the eDirectory
functionality will possibly be broken or it will not perform as expected.
The attributes that should not marked for encryption are:
Š
federationBoundaryType
Š
Volume
Š
ACL
Š
federationBoundary
Š
member
Š
federationControl
Š
federationSearchPath
Š
encryptionPolicyDN
Š
indexDefinition
Š
dgIdentity
Š
dgAllowUnknown
Š
agTimeout
Š
Host Server
Š
hostResourcePath
Š
ndsPredicateState
Š
ndsStatusExternalReference
Š
ndsStausLimber
Š
ndsStatusSchema
Though the list is not exhaustive, similar kind of attributes should not be marked for encryption.
10.1.3 Accessing the Encrypted Attributes
When you encrypt the attributes, you also protect the access to the encrypted attributes. This is
because eDirectory 8.8 and later can restrict the access to the encrypted attributes over secure
channel (LDAP secure channel or NCP secure channel.)
By default, the encrypted attributes can be accessed only through a secure channel.
However, if you want the clients to be able to access the encrypted attributes over clear text, then
disable the Always Require Secure Channel option. For more information, refer to
“Enabling and
Disabling Access to Encrypted Attributes Over Clear Text Channels” on page 245 .
Enabling and Disabling Access to Encrypted Attributes Over Clear Text Channels
You can enable or disable the access to encrypted attributes over clear text channels by enabling or
disabling Always Require Secure Channel option (that is, the attrEncryptionRequireSecure
attribute) using either iManager or LDAP.