[Samba] my samba3+ldap+SSO plan

[Andrew Bartlett]

On Wed, 2003-11-12 at 12:20, tbsky at annsky.com wrote:
> >>    although samba3 has PDC/BDC architechture, but it seems need a
> >> central
> >> wins server. and we don't need a browse list cross sites.
> >
> > No, this is not a requirement, as each site's 'PDC' can operate with
> > reference to the central LDAP infrastructure, without netbios.
> 
>    i see. thanks for the hint!! so just configure each samba
>    as PDC, right?

Yep. There is a small hitch in the way the replication works, I'll have
a patch in CVS fairly soon, so watch out for it and update before you
deploy.  The issue is about 'ldap rebind sleep' (we need to wait for our
local slave to catch up with the master, after we change the master).

> >>    my concern is about machine account.i know client machine and server
> >> keep a shared seceret. but i don't know if this seceret will
> >>    changing over time? or the seceret will keep staic?
> >
> > It changes over time, and the client will not contact the PDC to make
> > that change.  It will ask the local DC it is connected to.
> >
> >>    and although openldap has replication feature, but multi-master
> >>    replication seems experimental and hard to maintain.
> >>    we don't need real time replication. are there existing tools for
> >>    syncing entries between two ldap servers?
> >
> > You really should have one master LDAP server, and slaves for all the
> > remote sites.  These slaves will only need to contact the master on
> > machine account change, adding machines etc.
> 
>     but since the machine account password chagne over time, it
> allways need to talk to master LDAP, right? what happen if the
> wan link break?

How often does this happen?

In any case, it just fails, and the machine tries again later. 
Similarly if your users change their passwords or you do some admin
changes they will just need to just try later.

Andrew Bartlett

-- 
Andrew Bartlett                                 abartlet at pcug.org.au
Manager, Authentication Subsystems, Samba Team  abartlet at samba.org
Student Network Administrator, Hawker College   abartlet at hawkerc.net
http://samba.org     http://build.samba.org     http://hawkerc.net
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
Url : http://lists.samba.org/archive/samba/attachments/20031112/3faa19da/attachment.bin