Novell OPEN ENTERPRISE SERVER - CONVERSION GUIDE 12-2010, Implementation Manual

Page: 293 / 296

Coordinating Password Policies Among Multiple File Services 293
S9

Use the same procedure as for S5.

Either use a common proxy user for all the services (AFP), or allow auto-generation of the
proxy user/password for each AFP.
K.4.2 Deployment Scenario 2: Mutually /Exclusive Users
In some trees, AFP, CIFS, and Samba might be employed, but the users are partitioned in such a way
that each user has access to AFP, to CIFS or to Samba, but not to all of them.
S1, S2, S3, S4
DSfW servers with Samba. All the users are under dc=blr,dc=widgets,dc=com.

You can use the default Password policy provided by Domain Services for Windows for all the
users in this subtree.

You can create and use a single proxy user/password under dc=blr,dc=widgets,dc=com for all
the servers providing Samba.
K.4.3 Deployment Scenario 3: Simple deployments
Simple deployments require very little planning.
Auto-generated proxy users by each service might be a good idea.
K.4.4 Modifying User Password Policies after AFP/CIFS/
Samba/DSfW Is Installed
After a new password policy is assigned to an AFP/CIFS/Samba or DSfW user, rerun the YaST–
based configuration and select the new Password policies.
K.4.5 Adding New User eDirectory Contexts to AFP/CIFS after
AFP/CIFS/Samba/DSfW Is Installed.
After a new password policy is assigned to a Samba or DSfW user, rerun the YaST–based
configuration and select the new Password policies.
K.4.6 Enabling File Access for DSfW Servers Across Domains
DSfW requires that users be LUM-enabled to access NSS file services through Samba. For a user to
access a DSfW server in a different domain, the user needs to be a LUM-enabled user on the other
server. DSfW provisioning establishes shortcut trust between domains. Users from other domains in
the forest can access non-NSS volumes as long as they have rights on the resources.
To achieve this, the context of the partition root for the user object should be added as a search
context for LUM. This needs to be done in addition to the trustee rights provided to the user (or the
user's group) as part of file system rights.