mirror of
https://git.openldap.org/openldap/openldap.git
synced 2024-12-21 03:10:25 +08:00
107 lines
3.6 KiB
Plaintext
107 lines
3.6 KiB
Plaintext
# $OpenLDAP$
|
|
# Copyright 1999-2000, The OpenLDAP Foundation, All Rights Reserved.
|
|
# COPYING RESTRICTIONS APPLY, see COPYRIGHT.
|
|
|
|
H1: Constructing a Distributed Directory Service
|
|
|
|
For many sites, running one or more {{slapd}}(8) that hold an
|
|
entire subtree of data is sufficient. But often it is desirable
|
|
to have one {{slapd}}} refer to other directory services for a
|
|
certain part of the tree (which may or may not be running {{slapd}}).
|
|
|
|
!if 0
|
|
{{slapd}} supports {{subordinate}}, {{immediate superior}},
|
|
and {{superior}} knowledge information.
|
|
!else
|
|
{{slapd}} supports {{subordinate}} and {{superior}} knowledge information.
|
|
!endif
|
|
|
|
|
|
H2: Subordinate Knowledge Information
|
|
|
|
Subordinate knowledge information may be provided to delegate
|
|
a subtree.
|
|
Subordinate knowledge information is maintained in the directory
|
|
as a special {{referral}} object at the delegate point.
|
|
The referral object acts as a delegation point, gluing two servcies
|
|
together.
|
|
This mechanism allows for hierarchial directory services to to be
|
|
constructed.
|
|
|
|
A referral object has an structural object class of
|
|
{{EX:referral}} and has the same {{TERM[expand]DN}} as the
|
|
delegated subtree. Generally, the referral object will also
|
|
provide the auxiliary object class {{EX:extensibleObject}}.
|
|
This allows the entry to contain appropriate {{TERM[expand]RDN}}
|
|
values. This is best demonstrated by example.
|
|
|
|
If the server {{EX:a.example.net}} holds {{EX:dc=example,dc=net}}
|
|
and wished to delegate the subtree {{EX:ou=subtree,dc=example,dc=net}}
|
|
to another server {{EX:b.example.net}}, the following named referral
|
|
object would be added to {{a.example.net}}:
|
|
|
|
E: dn: dc=subtree, dc=example, dc=net
|
|
E: objectClass: referral
|
|
E: objectClass: extensibleObject
|
|
E: dc: subtree
|
|
E: ref: ldap://b.example.net/dc=subtree,dc=example,dc=net/
|
|
|
|
The server uses this information to generate referrals and
|
|
search continuations to subordinate servers.
|
|
|
|
For those familiar with X.500, a {{named referral}} object is
|
|
similar to an X.500 knowledge reference held in a {{subr}}
|
|
{{TERM:DSE}}.
|
|
|
|
|
|
!if 0
|
|
H2: Immediate Superior Knowledge Information
|
|
|
|
Immediate superior knowledge information may be provided in the
|
|
entry at the root of a delegated subtree. The knowledge information
|
|
is contained with {{ref}} operational attribute.
|
|
|
|
Extending the example above, a {{ref}} attribute can be added
|
|
to the entry {{EX:dc=subtree,dc=example,dc=net}} in server B indicating
|
|
that A holds the immediate superior naming context.
|
|
|
|
E: dn: dc=subtree, dc=example, dc=net
|
|
E: changetype: modify
|
|
E: add: ref
|
|
E: ref: ldap://a.example.net/
|
|
|
|
The server uses this information to generate referrals to
|
|
managment operations.
|
|
|
|
For those familiar with X.500, this use of the {{ref}} attribute
|
|
is similar to an X.500 knowledge reference held in a
|
|
{{immSupr}} {{TERM:DSE}}.
|
|
!endif
|
|
|
|
|
|
H2: Superior Knowledge Information
|
|
|
|
Superior knowledge information may be specified using the
|
|
{{EX:referral}} directive. The value is a list of {{TERM:URI}}s
|
|
referring to superior directory services. For servers
|
|
without immediate superiors, such as for {{EX:a.example.net}}
|
|
in the example above, the server can be configured to use
|
|
directory service with {{global knowledge}}, such as the
|
|
OpenLDAP Root Service.
|
|
|
|
E: referral ldap://root.openldap.org/
|
|
|
|
However, as {{EX:a.example.net}} is the {{immediate superior}}
|
|
to {{EX:b.example.net}}, {{a.example.net}} would be configured
|
|
as follows:
|
|
|
|
E: referral ldap://a.example.net/
|
|
|
|
The server uses this information to generate referrals to
|
|
operations acting upon operations not within or subordinate
|
|
to any of the naming contexts held by the server.
|
|
|
|
For those familiar with X.500, this use of the {{ref}} attribute
|
|
is similar to an X.500 knowledge reference held in a
|
|
{{Supr}} {{TERM:DSE}}.
|