Red Hat DIRECTORY SERVER 8.1 - DEPLOYMENT Deployment Manual

Also see for 8.1: Installation guide Release note Using instruction Reference Using instructions

Contents

Red Hat DIRECTORY SERVER 8.1 - DEPLOYMENT Deployment Manual Manual pdf 117 page image

User Schema Differences between Red Hat Directory Server and Active Directory1077.3.2.1. Values for cn AttributesIn Directory Server, the cn attribute can be multi-valued, while in Active Directory this attribute musthave only a single value. When the Directory Server cn attribute is synchronized, then, only one valueis sent to the Active Directory peer.What this means for synchronization is that,potentially, if a cn value is added to an Active Directoryentry and that value is not one of the values for cn in Directory Server, then all of the Directory Servercn values are overwritten with the single Active Directory value.One other important difference is that Active Directory uses the cn attribute attribute as its namingattribute, where Directory Server uses uid. This means that there is the potential to rename theentry entirely if the cn attribute is edited in the Directory Server. If that cn change is written over tothe Active Directory entry, then the entry is renamed, and the new named entry is written back overto Directory Server. This only happens, however, if the cn attribute is synced. If the change is notsynchronized, then the entry is not renamed.7.3.2.2. Password PoliciesBoth Active Directory and Directory Server can enforce password policies such as password minimumlength or maximum age. Windows Sync makes no attempt to ensure that the policies are consistent,enforced, or synchronized. If password policy is not consistent in both Directory Server and ActiveDirectory, then password changes made on one system may fail when synched to the other system.The default password syntax setting on Directory Server mimics the default password complexity rulesthat Active Directory enforces.7.3.2.3. Values for street and streetAddressActive Directory uses the attribute streetAddress for a user or group's postal address; this isthe way that Directory Server uses the street attribute. There are two important differences in theway that Active Directory and Directory Server use the streetAddress and street attributes,respectively:• In Directory Server, streetAddress is an alias for street. Active Directory also has thestreet attribute, but it is a separate attribute that can hold an independent value, not an alias forstreetAddress.• Active Directory defines both streetAddress and street as single-valued attributes, whileDirectory Server defines street as a multi-valued attribute, as specified in RFC 4519.Because of the different ways that Directory Server and Active Directory handle streetAddress andstreet attributes, there are two rules to follow when setting address attributes in Active Directory andDirectory Server:• Windows Sync maps streetAddress in the Windows entry to street in Directory Server. Toavoid conflicts, the street attribute should not be used in Active Directory.• Only one Directory Server street attribute value is synced to Active Directory. If thestreetAddress attribute is changed in Active Directory and the new value does not already existin Directory Server, then all street attribute values in Directory Server are replaced with the new,single Active Directory value.