Novell IFOLDER 3.7 - SECURITY ADMINISTRATION, Administration Manual

Page: 27 / 216

Planning iFolder Services 27
no
vd
ocx
(e
n)
13
Ma
y 20
09
2.3.1 LDAP Naming Requirement
Usernames and passwords must comply with the constraints set by your LDAP service. For
information, see the
Novell eDirectory 8.8 Administration Guide (http://www.novell.com/
documentation/edir88/treetitl.html) .
2.3.2 Length and Format Considerations for an LDAP Object
In iManager, the maximum number of characters for most LDAP objects is 64 characters. Some
fields require common name format and others require fully distinguished name format for objects.
View the iManager Help for the different plug-ins to make sure your entries comply with length and
format restrictions for the individual plug-in.
2.3.3 Multilingual Considerations
If you have workstations running in different languages, you might want to limit User object names
to characters that are viewable on all the workstations. For example, a name entered in Japanese
cannot contain characters that are not viewable in Western languages.
IMPORTANT: eDirectory supports only English language characters for usernames and passwords
on Linux and HP-UNIX. This applies to OES 2 Linux SP1 and SLED.
For information, see “Multilingual Considerations” (http://www.novell.com/documentation/edir88/
edir88/data/a2iiidp.html#a2iiie7) in the Novell eDirectory 8.8 Administration Guide.
2.4 Admin User Considerations
During the iFolder install, iFolder creates two Administrator users, the iFolder Admin user and the
iFolder Proxy user. After the install, you can also configure other users with the iFolder Admin right
to make them equivalent to the iFolder Admin user.
Š
Section 2.4.1, “iFolder Admin User and Equivalent Users,” on page 27
Š Section 2.4.2, “iFolder Proxy User,” on page 28
2.4.1 iFolder Admin User and Equivalent Users
The iFolder Admin user is the primary administrator of the iFolder enterprise server. Whenever
iFolders are orphaned, ownership is transferred to the iFolder Admin user for reassignment to
another user or for deletion. You initially specify the iFolder Admin user during the iFolder
enterprise server configuration in YaST.
The iFolder Admin user must be provisioned to enable the iFolder Admin to perform management
tasks. iFolder tracks this user by the LDAP object GUID, allowing it to belong to any LDAP
container or group in the tree, even those that are not identified as LDAP Search contexts.
The iFolder Admin right can be assigned to other users so that they can also manage iFolder services
for the selected server. Use the Web Admin console to add or remove the iFolder Admin right for
users. Only users who are in one of the contexts specified in the LDAP Search contexts are eligible
to be equivalent to the iFolder Admin user.