PC-DCE Administrator's Guide

Software Version 5.0

Revised March 2003

Contents

Notices

Intended Audience
Documentation

PC-DCE Documentation Set
The Open Group Documentation

Contacting Entegrity Solutions
Obtaining Technical Support
Obtaining Additional Technical Information 5 Obtaining Additional Technical Information

1.1 What Is Cell Topology?
1.2 Cell Topology Design and Test Methodology
1.3 Number and Location of Cells

1.3.1 Performance
1.3.2 Administration
1.3.3 Geographical and Functional Distribution of Users
1.3.4 Cell Tuning
1.3.5 Maintaining System Time

1.4 Full Clients and Lightweight Clients
1.5 Application Requirements
1.6 Server Locations
1.7 Machine and Network Requirements

1.7.1 Security Service Servers
1.7.2 CDS Servers
1.7.3 Network Connections

1.8 Intercell Communication

2.1 General Strategies

2.1.1 Configuration Tools

2.2 Installing PC-DCE on Multiple Systems

2.2.1 Controlling Bootup After Installation
2.2.2 Automated Distribution Tools
2.2.3 Manual Installation

2.3 Configuring PC-DCE on Multiple Systems

2.3.1 How to Designate a Local Configuration Administrator
2.3.2 Using the Client Configuration Tool

2.3.2.1 Sample Use of dcecfgng

3.1 Using the DCE Director
3.2 Definitions
3.3 Name Formats
3.4 Duplicate Names
3.5 Managing Users

3.5.1 Creating Users
3.5.2 Showing User Information
3.5.3 Deleting Users

3.6 Managing Principals

3.6.1 Reserved Principals and Accounts
3.6.2 Adding Principals

3.6.2.1 Specifying a Full Name
3.6.2.2 Specifying an Object Creation Quota
3.6.2.3 Creating Multiple Principals

3.6.3 Showing Principal Information
3.6.4 Modifying Principals

3.6.4.1 Changing the Primary Name
3.6.4.2 Changing Principal Information
3.6.4.3 Adding an Alias to a Principal

3.6.5 Deleting Principals and Aliases
3.6.6 Recovering Orphaned Objects

3.7 Managing Groups and Organizations

3.7.1 Adding Groups and Organizations

3.7.1.1 Adding a Group
3.7.1.2 Adding an Organization

3.7.2 Showing Group and Organization Information
3.7.3 Modifying Groups and Organizations
3.7.4 Deleting Groups and Organizations
3.7.5 Maintaining Membership Lists

3.7.5.1 Effects of Account Creation on Membership Lists
3.7.5.2 Adding and Deleting Group Members
3.7.5.3 Displaying Membership Lists

3.8 Managing Accounts

3.8.1 User Accounts
3.8.2 Creating an Account

3.8.2.1 Account Attribute Values

3.8.3 Showing an Account
3.8.4 Modifying an Account
3.8.5 Deleting an Account

4.1 Understanding DCE Authentication

4.1.1 DCE Authentication Process
4.1.2 OSF DCE Version 1.1 Authentication Enhancements

4.1.2.1 Preauthentication Protocols
4.1.2.2 Preauthentication Interoperability Between DCE Versions

4.1.3 Privilege Attributes
4.1.4 Ticket-Granting Tickets and Service Tickets

4.2 Managing DCE Authentication

4.2.1 Managing Preauthentication Protocols

4.2.1.1 Creating a Principal with the pre_auth_req ERA
4.2.1.2 Viewing a Principal's ERAs
4.2.1.3 Adding the pre_auth_req ERA to an Existing Principal
4.2.1.4 Modifying a Principal's pre_auth_req ERA Value

4.2.2 Managing Privilege Attributes and Tickets

4.2.2.1 Viewing Privilege Attributes and Tickets
4.2.2.2 Destroying Tickets

4.3 Managing Invalid Login Handling

4.3.1 Creating a Principal with Attached Invalid Login ERAs
4.3.2 Viewing a Principal's ERAs
4.3.3 Adding Invalid Login ERAs to an Existing Principal
4.3.4 Modifying a Principal's Invalid Login ERA Values
4.3.5 OSF DCE Version 1.1 Limitation

4.4 Managing Password Format Policies

4.4.1 Viewing Password Format Settings
4.4.2 Changing Password Format Settings

4.5 Using the Password Strength Server

4.5.1 Configuring the Password Strength Server
4.5.2 Configuring Principals to Use the Password Strength Server

4.5.2.1 Creating a Principal with Password Management ERAs
4.5.2.2 Viewing a Principal's ERAs
4.5.2.3 Adding Password Management ERAs to a Principal
4.5.2.4 Modifying a Principal's Password Management ERA Values
4.5.2.5 Using The Binding Encoding Type

4.5.3 Running the Password Strength Server from the Command Line

4.5.3.1 Overriding Policy from the Command Line

4.5.4 Generating Randomized Passwords

4.5.4.1 Password Generation Restriction

4.5.5 Viewing Password Strength Server Log Messages

4.6 Managing Password Expiration

4.6.1 Viewing Password Expiration Settings
4.6.2 Changing Password Expiration Settings
4.6.3 Overriding Password Expiration

4.6.3.1 Creating a Principal with the passwd_override ERA
4.6.3.2 Viewing a Principal's passwd_override ERA
4.6.3.3 Adding the passwd_override ERA to a Principal
4.6.3.4 Modifying a Principal's passwd_override ERA Value

4.7 Integrated Login
4.8 Login Contexts

5.1 Definitions
5.2 Server Locations and Requirements

5.2.1 Locating Servers

5.2.1.1 For Performance
5.2.1.2 For Fault-Tolerance
5.2.1.3 For Security

5.3 Managing Cells

5.3.1 Showing All Configured DCE Servers and DCE Hosts
5.3.2 Testing Whether a DCE Server is Running
5.3.3 Testing Whether a DCE Host is Running
5.3.4 Testing Cell Operation

5.4 Incorporating Replicas into a Cell

5.4.1 Choosing the Number of Replicas

5.5 Managing CDS Replicas

5.5.1 Understanding the PC-DCE Default CDS Replica Configuration
5.5.2 Why Modify the Default PC-DCE CDS Replica Configuration?
5.5.3 Basic CDS Replica Management Tasks

5.5.3.1 Determining the Structure of the CDS Directory Tree
5.5.3.2 Creating a New Directory Replica
5.5.3.3 Synchronizing a Directory Replica
5.5.3.4 Changing Mastership of a Replica

5.5.4 CDS Replica Management Procedures

5.5.4.1 Creating a Backup Server
5.5.4.2 Creating a Backup Server for Failover
5.5.4.3 Converting a Backup Server to a Primary Server

5.6 Managing Security Service Replicas

5.6.1 Promoting a Slave to Master

5.7 Removing and Reconfiguring a PC-DCE Server

5.7.1 Removing Cell References to the Server
5.7.2 Reconfiguring the Server

5.8 Backing Up and Restoring a PC-DCE Server

5.8.1 Backing Up (With Servers Stopped)
5.8.2 Backing Up (With Servers Running)
5.8.3 Restoring
5.8.4 PC-DCE Master Security Server Upgrade

5.9 Using Locksmith Mode to Repair Registry Damage

5.9.1 Automatic Changes to the Locksmith Account
5.9.2 Starting the Security Server in Locksmith Mode

5.10 Handling Security Replica IP Address Changes
5.11 Using the Name Service Interface Gateway

5.11.1 Configuring the nsid
5.11.2 Security Considerations
5.11.3 The Microsoft Locator and the nsid
5.11.4 The Microsoft Registry and the nsid
5.11.5 Modifying the Windows NT Registry for Using the nsid

5.11.5.1 To Modify the Registry Through the Windows Control Panel:
5.11.5.2 To Modify the Registry by Using the Registry Editor:

6.1 Using timesync.exe to Synchronize System Time
6.2 Controlling CDS Cache Operations

6.2.1 CDS Cache Overview

6.2.1.1 Cache Implementation
6.2.1.2 Lifetime of Cached Information
6.2.1.3 CDS Cache Size
6.2.1.4 How a Client Selects a Clearinghouse
6.2.1.5 How a Client Builds the Clearinghouse List
6.2.1.6 How a Client Sorts the Clearinghouse List

6.2.2 Tuning the Update Rate of the Cached Clearinghouse List
6.2.3 Using CDS Preferencing to Control Sorting of the Clearinghouse List

6.2.3.1 How CDS Preferencing Works
6.2.3.2 Creating the Preference File
6.2.3.3 Viewing Ranks
6.2.3.4 CDS Preferencing Example

6.2.4 Refreshing Cached Application Server Data

6.3 Controlling Client Selection of Security Servers

6.3.1 Forcing the Runtime to Use pe_site
6.3.2 Controlling the Rate of pe_site File Updates
6.3.3 Using an RPC Profile to Specify a Preferred Security Server

7.1 Understanding Trust Relationships

7.1.1 Direct Trust Relationships

7.1.1.1 User Access to the Foreign Cell
7.1.1.2 Controlling Authorization for Objects in the Cell

7.2 Pros and Cons of Intercell Trust Relationships

7.2.1 Simplified Administration
7.2.2 Simplicity for the User
7.2.3 Security Implications

7.3 Establishing Intercell Communications

7.3.1 Establishing Intercell Lookup
7.3.2 Establishing Intercell Trust

7.3.2.1 What Happens When You Create an Account for the Foreign Cell

7.3.3 Verifying Account Creation
7.3.4 Modifying the Account Valid Flag
7.3.5 Adding Entries for Replica Servers to DNS

A.1 Registry Keys
A.2 Environment Variables

A.2.1 Variables for Tuning sec_key_mgmt_manage_key()
A.2.2 Variable for Multi-homed Machines

B.1 Situations that Trigger Failover

B.1.1 Situations That Do Not Trigger Failover

B.1.1.1 Full Client Startup and the CDS Server
B.1.1.2 Interaction Between Application and Servers

B.2 Requirements for Successful Failover
B.3 Failover Test Environment
B.4 Failover Test Results

B.4.1 Failover when the CDS or Security Server is Not Running
B.4.2 Failover when the Server System is Unreachable

B.4.2.1 Client Performs a CDS Lookup
B.4.2.2 Client Logs into DCE

B.5 Factors that Affect Failover

B.5.1 Cache Contents
B.5.2 PE_Site File Use
B.5.3 Endpoint Mappers
B.5.4 Registry Keys
B.5.5 Replicas Across a WAN Link

B.6 Application Server Failover
B.7 Responding to Loss of Service

[Next] [Index]

To make comments or ask for help, contact support@entegrity.com.

Portions of this document were derived from materials provided by Compaq Computer Corporation. Copyright © 1998-2003 Compaq Computer Corporation.

Copyright © 2003 Entegrity Solutions Corporation & its subsidiaries.

All rights reserved.