Novell IFOLDER 3.7 - SECURITY ADMINISTRATION, Administration Manual

Page: 29 / 216

Planning iFolder Services 29
no
vd
ocx
(e
n)
13
Ma
y 20
09
2.5 iFolder User Account Considerations
This section describes iFolder user account considerations.
Š
Section 2.5.1, “Preventing the Propagation of Viruses,” on page 29
Š
Section 2.5.2, “Synchronizing User Accounts with LDAP,” on page 29
Š
Section 2.5.3, “Synchronizing LDAPGroup Accounts with LDAP,” on page 30
Š
Section 2.5.4, “Setting Account Quotas,” on page 31
2.5.1 Preventing the Propagation of Viruses
Because iFolder is a cross platform, distributed solution there is a possibility of virus infection on
Windows machines when migrating data across the iFolder server to other platforms, and vice versa.
You should enforce server-based virus scanning to prevent viruses from entering the corporate
network.
You should also enforce client-based virus scanning. For information, see “ Configuring Local Virus
Scanner Settings for iFolder Traffic ” in the OES 2 SP1: Novell iFolder 3.7 Cross-Platform User
Guide .
2.5.2 Synchronizing User Accounts with LDAP
You can specify any existing containers and groups in the Search DNs field of the iFolder LDAP
settings. Based on the Search DNs, users are automatically provisioned with accounts for iFolder
services.
The list of iFolder users is updated periodically when the LDAP synchronization occurs. New users
are added to the list of iFolder users. Deleted users are removed from the list of iFolder users. (This
might create orphaned iFolders if the deleted user owned any iFolders). If by mistake user is deleted
from the LDAP, you can create that user again with the same FDN within the
Delete member grace
interval so that you can recover the user’s iFolders. For more information on this, see Step 7 on
page 133 in the “Accessing and Viewing the Server Details Page” on page 132 .
IMPORTANT: Whenever you move a user between contexts and you want to provide continuous
service for the user, make sure to add the target context to the list of LDAP Search DNs before you
move the User object in eDirectory.
The LDAP synchronization tracks a user object’s eDirectory
TM
GUID to identify the user in multiple
contexts. It tracks as you add, move, or relocate user objects, or as you add and remove contexts as
Search DNs.
The following guidelines apply:
Š If the user is added to an LDAP container, group, or user that is in the Search DN, the user is
added automatically to the iFolder user list.
Š
If a user is moved to a different container, and the new container is also in the Search DN, the
user remains in the iFolder user list.
If you intend to keep the user as an iFolder user without interruption of service and loss of
memberships and data, the new container must be added as a Search DN before the user is
moved.