Next Page

Banyan Directory Synchronization for Netscape

Chapter 1 - Introduction

This guide documents the procedures that administrators perform to install and configure Banyan Directory Synchronization on Netscape Directory Servers on their networks.

The procedures in this guide are written for system administrators planning to use Banyan Directory Synchronization for Netscape. Administrators should be familiar with their platform hardware and their network operating systems, including Banyan LDAP for StreetTalk, Banyan StreetTalk® for Windows NT®, and Netscape® Directory Server®. General knowledge of directories and LDAP is essential. For further information about LDAP and directories, refer to LDAP for StreetTalk Administrator's Guide or other books about LDAP.

The following sections compose this guide:
Overview of Banyan Directory Synchronization - Introduces synchronizing StreetTalk entries between directories on an LDAP for StreetTalk server and a Netscape Directory Server.
Installing Banyan Directory Synchronization - Provides detailed instructions for installing and configuring synchronization on your Netscape Directory Server.
Configuring Banyan Directory Synchronization on LDAP for StreetTalk Services - Outlines configuring LDAP for StreetTalk services to support directory synchronization with your selected Netscape Directory Server. For more information on configuring LDAP for StreetTalk services to support directory synchronization, refer to LDAP for StreetTalk Administrator's Guide that accompanied your LDAP for StreetTalk 3.5 software.

Additional Documentation

Refer to the following locations for additional documentation on Netscape Directory Server 4.0:
http://home.netscape.com
http://developer.netscape.com

Overview of Banyan Directory Synchronization

Directory synchronization ensures that modifications made to either the LDAP for StreetTalk service directory or the Netscape Directory Server are written to both LDAP databases. Banyan Directory Synchronization (also called the plug-in in this guide) replicates StreetTalk user (inetOrgPerson) and StreetTalk list (groupOfNames) entries from Banyan LDAP for StreetTalk to a selected Netscape Directory Server (NSDS). To implement directory synchronization, Banyan installs a pre-operation plug-in on the NSDS and adds a new configuration option to LDAP for StreetTalk services.

Details about using plug-ins to customize Netscape Directory Servers are documented in the Netscape Directory Server Programmer's Guide. You use plug-ins to enhance, extend, and alter the behavior of the directory server. Banyan Directory Synchronization plug-in is a pre-operation plug-in-a plug-in that Netscape Directory Server runs before it performs any LDAP operation. The plug-in forwards bind, modify, add, delete, and modify relative distinguished name operations to Banyan LDAP for StreetTalk. Modifications are then replicated to the Netscape Directory Server. The plug-in lets LDAP for StreetTalk replicate its directory entries to the Netscape Directory Server when the NSDS receives a modification request that includes the authorized DN and authorized password from LDAP for StreetTalk.

Banyan Directory Synchronization works with Netscape Directory Server 4.0 and Banyan LDAP for StreetTalk 3.5 or greater. With synchronization enabled, Banyan LDAP for StreetTalk replicates its entries to a specified portion of the directory (identified by the subtree DN and called the directory tree subtree) on a Netscape Directory Server. The directory synchronization plug-in for NSDS intercepts LDAP bind and modify requests sent to the Netscape Directory. The plug-in forwards the requests to the Banyan LDAP for StreetTalk service, receives the response from the service, and then passes the response to the Netscape Directory Server. The NSDS makes the requested changes to its LDAP database.

Figure 1. Banyan Directory Synchronization Plug-In
Redirects LDAP Change Requests to LDAP for StreetTalk
Before NSDS Processes the Request

When the plug-in receives an LDAP operation request to modify the Banyan entries in the NSDS database, the following processes occur (refer to Figure 1):

1. Banyan Directory Synchronization plug-in directs the request to the Banyan LDAP for StreetTalk server.

2. If the user's access rights permit the action, the modify operation takes place in the Banyan LDAP for StreetTalk database.

3. The modified portion of the Banyan LDAP for StreetTalk database is transmitted to the Netscape Directory Server to synchronize the directory data.

Note
NSDS and LDAP for StreetTalk share StreetTalk user names and lists. StreetTalk services and nicknames are not shared between the two servers.

Installing the Banyan Directory Synchronization Plug-In

This section of the guide describes how to install and configure the directory synchronization plug-in on the Netscape server.

Plug-In Installation Overview

Banyan Directory Synchronization for Netscape software installation involves running the plug-in installation program and completing a couple of manual steps to finish configuring the plug-in and NSDS.

After gathering the information listed in the section "Plug-in Installation Requirements", you perform the following tasks to install and configure the plug-in:

1. Run the plug-in installation program.

2. Create the directory tree subtree, if it does not exist.

3. Create the authorized DN and password, if they do not exist.

At this point, you have completed the installation on the Netscape Directory Server. If you have configured the LDAP for StreetTalk server as well, you are ready to synchronize the databases.

Plug-in Installation Requirements

Your servers must meet the following software requirements to support directory synchronization:

Your Netscape Directory Server must be running version Netscape Directory Server 4.0
Your StreetTalk for Windows NT server must be running LDAP for StreetTalk 3.5 or greater

When you install the synchronization software on the Netscape Directory Server, you are installing a pre-operation plug-in on the server. NSDS software lets you create more than one directory server instance on a directory server. Each directory server instance on a server has its own instance identifier. You install the plug-in to the directory server instance you select. Therefore, before you install directory synchronization software, determine the identifier of the directory server instance to use for synchronization. In addition, you need the information for the LDAP for StreetTalk server with which to synchronize LDAP directories. Configuration information prerequisites are summarized below.

For your Netscape Directory Server:

Server instance identifier to use for synchronization
Server instance's database in which to store the LDAP for StreetTalk subtree (usually ldbm)
Distinguished name (DN) of the subtree in the directory tree-new or existing
Authorized DN to be used for authorizing modifications to your directory tree-new or existing
Authorized DN password for authorizing modifications to your directory tree
Enterprise network objects to be synchronized-users, lists, or both

For the LDAP for StreetTalk server:

Server name or IP address
Server port number
LDAP for StreetTalk server suffix

Gathering the above information before installing the plug-in eases setup and helps ensure error-free synchronization between the two directory servers.

To Install the Plug-In

The Banyan Directory Synchronization for Netscape installation program is called "BanyanDirectorySynchronizationforNetscape.exe". Click Cancel on any installation dialog to stop the software installation process.

1. Locate and double-click the plug-in installation program BanyanDirectorySynchronizationforNetscape.exe. The Choose Destination Location dialog appears.

2. Click Next to accept the default location for storing the files, or click Browse to change the location. Banyan recommends you use the default location. Click Next. The Choose Netscape Directory Server dialog appears.

3. Select the Netscape directory server instance to use in your synchronization environment. List entries are the directory server instances that have been created on this directory server. Click Next. The Choose Netscape Directory Server Database dialog appears.

4. Select the database of the server instance to store the synchronization information.

Each directory server instance can work against one or more databases. To learn more about working with databases, refer to the web sites listed in the section "Additional Documentation" earlier in this guide.

Banyan recommends you use the database that is appropriate for your needs. Usually the default database for the directory server-ldbm-is the best choice.

5. Click Next. The Banyan Directory Synchronization Plugin Configuration dialog appears.

6. Enter configuration information for the Banyan Directory Synchronization plug-in.

Enter information in the following fields:

Subtree DN

Specifies the node in the Netscape directory server's directory tree that should be targeted for synchronization information. The plug-in uses the subtree DN, as well as the bind DN of the LDAP operation to determine if information coming into the directory server is subject to synchronization.

The node referred to by the subtree DN does not need to exist during installation. The plug-in installation program generates a skeleton LDIF file that you can use to add the node to the Netscape directory tree. You can find more information about LDIF files and adding the subtree node in the section "Additional Configuration Tasks" later in this guide.

Authorized DN

Specifies to the plug-in the LDAP user entry that is authorized to change data in the LDAP for StreetTalk portion of the Netscape directory server's directory. Enter the DN of a new user or an existing user whose access is restricted to the LDAP for StreetTalk subtree. Although the root DN of your Netscape directory server can be used here, it is not recommended. The root DN has access to the complete directory tree-you only need to provide access to the LDAP for StreetTalk subtree.

The authorized DN is usually stored in the base level of the Subtree DN, and is used only by the LDAP for StreetTalk service to bind to the Netscape directory server.

Authorized DN Password

Enter the password for the Authorized DN LDAP user object. You can enter up to 31 alphanumeric characters, including punctuation marks. All characters must be lower case. You must enter a password. You cannot leave this field blank.

Verify

Enter the authorized DN password again to verify you entered it correctly.

Server Name

Specifies the Banyan LDAP server to be used in the synchronization process. Enter the IP name, IP address, or Windows networking name for the server. Do not enter the StreetTalk name of the server.

Server Port

Specifies the port of the LDAP service on the Banyan LDAP for StreetTalk server configured above. Enter the port number user by the LDAP for StreetTalk service.

The default port number is 389.

Server Suffix

Specifies the suffix of the LDAP service on the Banyan LDAP server. Enter the suffix for the LDAP for StreetTalk service on the Banyan server.

LDAP Synchronization Objects

Specifies which StreetTalk network objects to synchronize. Select users (inetOrgPerson), lists (groupOfNames) or both.

By default, users is selected.

Default Plug-in State

Select whether the Banyan Directory Synchronization for Netscape plug-in is ON or OFF after installation is completed.

By default, the plug-in is ON.

7. Click Next through 2 dialogs.

The next two dialogs show the modifications that installing the plug-in makes to the directory server instance's configuration file. The first dialog shows the configuration file before the modifications. The second dialog presents the configuration file after the modifications. Installing the plug-in adds a plug-in directive string similar to the following to the directory server's configuration file:

plugin preoperation on `Banyan Directory Synchronization Plugin...

Use the horizontal scroll arrows at the bottom of the list to view the complete plug-in directive string. All configuration settings for directory synchronization appear in the directive string.

The configuration file is named slapd.database.conf. Database is the directory server database you chose. The installation program makes a backup copy of the existing server configuration file. The backup file has the same file name, with the BAK extension added.

8. Click Next on the Setup Complete screen to complete the first part of the installation. Continue on to the next section to complete the plug-in installation.

To Create the Directory Subtree Entry

Once you have installed the plug-in, there are a couple of steps necessary to complete the installation:

1. Create the base node for the LDAP for StreetTalk subtree in the NSDS directory

2. Create the authorized DN

These steps create LDAP entries in the NSDS directory tree to match the configuration you entered when you installed the plug-in. The installation program generates two LDIF files to help you create the directory tree entries-ADDDSUBTREE.LDIF and ADDAUTHDN.LDIF. Examples 1 and 2 present samples of the generated LDIF files.

dn: ou=stsubtree,o=banyan.com
objectclass: top
objectclass: organizationalUnit
ou: stsubtree
aci: (target="ldap:///ou=stsubtree,o=banyan.com") (targetattr="*") (version 3.0; acl "Banyan Directory Synchronization Authorized DN Full Access"; allow (all) userdn = "ldap:///cn=admin,ou=stsubtree,o=banyan.com";)

dn: cn=admin,ou=stsubtree,o=banyan.com
cn: admin
sn: admin
objectclass: top
objectclass: person
objectclass: inetOrgPerson
userpassword: password

When you install the directory synchronization plug-in, the installation program uses the server configuration data you entered to create the LDIF files.

To add the subtree DN and authorized DN entries to your directory server, perform LDAP modify operations on your Netscape Directory Server. Use the Netscape supplied ldapmodify command line tool with the root DN of the directory server. Refer to Netscape Directory Server 4.0 Administrator's Guide for more information on adding entries to your Netscape directory server.

If the Subtree DN that you entered during the installation program does not exist, use ADDSUBTREE.LDIF to help you create the subtree.

LDIF files are located in the destination folder you selected when you installed the plug-in. By default, the path to the LDIF files is c:\program files\banyan\banyan directory synchronization for netscape. Edit the file ADDSUBTREE.LDIF. The generated LDIF file assumes that the directory tree nodes that comprise the Subtree DN exist. If some of the nodes do not exist, insert LDIF update statements in the LDIF file to create the missing nodes. Use a text editor, such as Microsoft NotePad to edit the file ADDSUBTREE.LDIF.

To create the subtree DN, apply the LDIF file containing an ldapmodify command similar to the following:

ldapmodify -D "cn=bindDN" -w [password] -a -f addsubtree.ldif

where bindDN is a distinguished name that has write access to the directory tree. For example, you can enter the root DN for the server. In Netscape Directory Server, "cn=directory manager" is the default root DN. Password is the password for access to the directory server.

To Create the Authorized DN

If the authorized DN that you entered during the installation program does not exist, use ADDAUTHDN.LDIF to help you create the subtree.

LDIF files are located in the destination folder you selected when you installed the plug-in. By default, the path to the LDIF files is c:\program files\banyan\banyan directory synchronization for netscape. Edit the file ADDAUTHDN.LDIF. The generated LDIF file assumes that the directory tree

nodes that comprise the authorized DN exist. If some of the nodes do not exist, use the file ADDSUBTREE.LDIF to create the missing nodes.

To create the authorized DN, apply the LDIF file containing a command similar to the following:

ldapmodify -D "cn=bindDN" -w [password] -a -f addauthdn.ldif

where bindDN is a distinguished name that has write access to the directory tree. For example, you can enter the root DN for the server. In Netscape Directory Server, "cn=directory manager" is the default root DN. Password is the password for access to the directory server.

To Uninstall Banyan Directory Synchronization Plug-In

You remove Banyan Directory Synchronization for Netscape software by selecting Banyan Directory Synchronization for Netscape in the Add/Remove programs icon in the Control Panel.

When you remove the directory synchronization plug-in, the uninstall process:

Stops the Netscape directory server if it is running
Removes the plug-in directive from the Netscape Directory Server configuration file
Restores the state of the NSDS

You are responsible for cleaning up any data left in the directory tree after you remove the plug-in software.

To Reinstall Banyan Directory Synchronization

You must remove Banyan Directory Synchronization software before you reinstall it. You cannot install Banyan Directory synchronization over an existing installation of Banyan Directory Synchronization. If you try to install the software on a server that already has the software installed, you are directed to remove the existing software and rerun the installation program.

Changing the Configuration of Netscape Directory Server

When you install Banyan Directory Synchronization for Netscape, you set all necessary configuration options. To change the configuration values later, use the Netscape Console. As an alternate means to change the plug-in configuration, remove the plug-in from your Netscape directory server and reinstall the plug-in with the new configuration settings.

To access the synchronization configuration, start the Netscape Console. Double-click the name of the Netscape directory server whose synchronization configuration you are changing. This brings up the administration screen for the directory server. Click the Directory tab. In the left pane, select the folder Config. Click the folder Plug-ins to show the Banyan StreetTalk LDAP Synch Plug-in in the right pane. Double-click Banyan StreetTalk LDAP Synch Plug-in to open the plug-in property editor.

To change the plug-in configuration, search for the properties labeled NSSLAPD-PLUG-INARGn, where n is the argument number. These properties contain the following keyword values for configuration. These keywords are mandatory.

SUBTREEDN

Specifies the subtree in your Netscape directory server directory tree that is used in synchronization. The value assigned to this keyword must be an LDAP distinguished name.

AUTHDN

Specifies which LDAP user entry is used to administer the synchronization subtree specified by the SUBTREEDN keyword. Banyan LDAP for StreetTalk server uses the AuthDN to send synchronization operations to the Netscape directory server. The value assigned to this keyword must be an LDAP distinguished name.

SERVNAME

Specifies the Banyan LDAP for StreetTalk server to which this NSDS server synchronizes its directory. The value assigned to this keyword must be a valid Banyan LDAP for StreetTalk server IP name or IP address.

SERVPORT

The value assigned to this keyword must be the port number of the Banyan LDAP server specified by the SERVNAME keyword.

SERVSUFFIX

The value assigned to this keyword must be the suffix of the Banyan LDAP for StreetTalk server specified by the SERVNAME keyword.

SYNCHOBJECTS

The value assigned to this keyword must be any combination of the following:

users

Specifies that the synchronization software synchronizes users.

lists

Specifies that the synchronization software synchronizes lists.

These values can be combined to synchronize both users and lists. When using combinations of these values, separate the values by a comma. For example, the keyword value users,lists synchronizes Banyan StreetTalk users and lists.

Additional Configuration Tasks

After you use Netscape Console to make configuration changes, take additional steps to complete the configuration changes.

If you changed any Netscape directory configuration options, you must take the administrative steps necessary to ensure that the directory tree objects for the new configuration values exist. The directory tree configuration options are SUBTREEDN, and AUTHDN. Unlike the plug-in installation program, which created LDIF files to help you create the necessary LDAP objects in your directory tree, you are responsible for creating the new LDAP objects. Here are a few tasks to consider when changing configuration.

Delete the previous directory tree configuration options

Deleting the previous configuration keeps your directory tree clean and avoids extraneous LDAP entries.

Edit the file ADDSUBTREE.LDIF

Edit ADDSUBTREE.LDIF to match the new configuration. Use the following ldapmodify command to create the new subtree DN entry. Refer to the Netscape Directory Server documentation for more information.

ldapmodify -D "cn=bindDN" -w [password] -a -f addsubtree.ldif

where bindDN is a distinguished name that has write access to the directory tree. For example, you can enter the root DN for the server. In Netscape Directory Server, "cn=directory manager" is the default root DN. Password is the password for access to the directory server.

Edit the file ADDAUTHDN.LDIF

Edit ADDAUTHDN.LDIF to match the new configuration. Use the following ldapmodify command to create the authorized DN entry. When you edit the file, pay particular attention to editing the password and access control instruction.

ldapmodify -D "cn=bindDN" -w [password] -a -f addauthDN.ldif

where bindDN is a distinguished name that has write access to the directory tree. For example, you can enter the root DN for the server. In Netscape Directory Server, "cn=directory manager" is the default root DN. Password is the password for access to the directory server.

Lastly, restart Netscape Directory Server to apply the configuration changes.

Synchronization Logging on the Netscape Directory Server

The synchronization software on the Netscape Directory server performs its logging in the Directory Server error log.

Follow these steps to turn logging on.

1. Launch the Netscape Console.

2. Click the Console tab.

3. Double-click on your directory server instance.

4. In the new window for your directory server instance, click the Configuration tab.

5. Click the Error Log tab.

6. Under Log Level, CTRL-click the Plug-in log level. Use CTRL-click to maintain other log level settings.

7. Click Save and restart the directory server to have your changes take affect.

Top Of PageNext Page