Novell EDIRECTORY 8.8 SP3, Administration Manual, Page: 374 / 634

374 Novell eDirectory 8.8 Administration Guide
n
ov
do
cx (e
n)
11
Ju
ly 20
08
Always Refer
The Always Refer option follows the same logic as Prefer Referrals, except that the Default Referral
is sent under various failover situations (for example, an object is not found or the server is down).
If another server that holds the rest of the data isn't running the LDAP service, the first LDAP server
won't chain the request to the second server.
If you mark the Always Refer option, you are allowed to enter a default referral. The Default
Referral field enables you to glue two different vendor LDAP servers together and build your own
Directory tree.
Scenario: Using a Default Server— You have an LDAP tree. One part of the tree is serviced by
eDirectory. A subordinate partition is serviced by iPlanet. In the Default Referral field, you place a
URL that references the iPlanet server. An LDAP client requests a search.
Unable to resolve the base DN, the LDAP server sends the client the string in the Default Referral
field. The referral instructs the LDAP client to look in the place specified in the URL The LDAP
client contacts the iPlanet server, which completes the search.
Whenever a default referral is configured and the server doesn't find the base DN being searched for,
the client receives the default referral.
The format for a referral is an LDAP URL (for example, LDAP://123.23.45.6:389).
When the LDAP server sends a default referral to a client (because the base DN was unavailable),
the server appends an additional forward slash (/) and the DN that the client was looking for. The
default referral and the appended information go to the client. The client sends the search request to
the server specified in the default referral.
The LDAP Group object has a string field for the default referral. The LDAP server treats that data
as a string. There is no validation. Whatever is entered is prepended to the referral. Some data is
appended to the referral. The LDAP server expects the string to look like a URL.
When clients get referrals to other eDirectory servers that are running LDAP, the client receives two
referrals per server:
Š
A referral directing the client to the clear-text port
Š A referral directing the client to the secure port
To differentiate between the two referrals, the clear-text referral states ldap:// and the secure port
displays ldaps://.
A referral from the server appends the port number.
Setting Referrals for Other Operations
The historical referral option setting only applied to the search operation. To provide a comparable
option for other operations, the ldapOtherReferralOption attribute is used. This attribute allows the
same values and controls the behavior for non-search operations (excluding bind, which never sends
a referral).