hi:
our company want to use samba3+openldap with singal sign on.
we have several branches.people would travel arround head
quarter and branches with their notebooks. so we don't have
roaming users, but we do have roaming computers.
we want to use a single domain for every site, and we want
every site keep working even when wan link is broken.
my plan below:
1. place one samba server and one ldap server at HQ and each site.
2. make every site to be a full working PDC, so every samba is
wins server and authenticate user via local ldap server.
3. at night, sync ldap entries from each brach to HQ,
then sync HQ ldap entries to every branch. (is this possible??)
although samba3 has PDC/BDC architechture, but it seems need a central
wins server. and we don't need a browse list cross sites.
in fact, we just want singal sign on for every site when people travel
arround with their notebooks.
my concern is about machine account.i know client machine and server
keep a shared seceret. but i don't know if this seceret will
changing over time? or the seceret will keep staic?
and although openldap has replication feature, but multi-master
replication seems experimental and hard to maintain.
we don't need real time replication. are there existing tools for
syncing entries between two ldap servers?
if there are better solution or if my plan is totally wrong,
please tell me. thanks for any advice !!!
Best Regards,
tbsky
Well, your plan is interesting, but as you already recognized - multimaster
LDAP servers are really hard to maintain and synchronize. Just think of
consistency of your data? Of course, that would work only if you really know
what attributes ( data ) you want to synchronize. But on the otherhand, you
could access your HQ LDAP server only when you need data of other branches,
and synchronize branches to one master server.
That is only a though, not a solution :)
Bye
SEFEROVIC Edvin
-----Urspr?ngliche Nachricht-----
Von: samba-bounces+edvin.seferovic=kolp.at@lists.samba.org
[mailto:samba-bounces+edvin.seferovic=kolp.at@lists.samba.org] Im Auftrag
von tbsky@annsky.com
Gesendet: Dienstag, 11. November 2003 12:10
An: samba@lists.samba.org
Betreff: [Samba] my samba3+ldap+SSO plan
hi:
our company want to use samba3+openldap with singal sign on.
we have several branches.people would travel arround head
quarter and branches with their notebooks. so we don't have
roaming users, but we do have roaming computers.
we want to use a single domain for every site, and we want
every site keep working even when wan link is broken.
my plan below:
1. place one samba server and one ldap server at HQ and each site.
2. make every site to be a full working PDC, so every samba is
wins server and authenticate user via local ldap server.
3. at night, sync ldap entries from each brach to HQ,
then sync HQ ldap entries to every branch. (is this possible??)
although samba3 has PDC/BDC architechture, but it seems need a central
wins server. and we don't need a browse list cross sites.
in fact, we just want singal sign on for every site when people travel
arround with their notebooks.
my concern is about machine account.i know client machine and server
keep a shared seceret. but i don't know if this seceret will
changing over time? or the seceret will keep staic?
and although openldap has replication feature, but multi-master
replication seems experimental and hard to maintain.
we don't need real time replication. are there existing tools for
syncing entries between two ldap servers?
if there are better solution or if my plan is totally wrong,
please tell me. thanks for any advice !!!
Best Regards,
tbsky
--
To unsubscribe from this list go to the following URL and read the
instructions: http://lists.samba.org/mailman/listinfo/samba
On Tue, 2003-11-11 at 22:10, tbsky@annsky.com wrote:> hi: > our company want to use samba3+openldap with singal sign on. > we have several branches.people would travel arround head > quarter and branches with their notebooks. so we don't have > roaming users, but we do have roaming computers. > we want to use a single domain for every site, and we want > every site keep working even when wan link is broken. > > my plan below: > > 1. place one samba server and one ldap server at HQ and each site. > 2. make every site to be a full working PDC, so every samba is > wins server and authenticate user via local ldap server. > 3. at night, sync ldap entries from each brach to HQ, > then sync HQ ldap entries to every branch. (is this possible??) > > although samba3 has PDC/BDC architechture, but it seems need a central > wins server. and we don't need a browse list cross sites.No, this is not a requirement, as each site's 'PDC' can operate with reference to the central LDAP infrastructure, without netbios.> in fact, we just want singal sign on for every site when people travel > arround with their notebooks. > my concern is about machine account.i know client machine and server > keep a shared seceret. but i don't know if this seceret will > changing over time? or the seceret will keep staic?It changes over time, and the client will not contact the PDC to make that change. It will ask the local DC it is connected to.> and although openldap has replication feature, but multi-master > replication seems experimental and hard to maintain. > we don't need real time replication. are there existing tools for > syncing entries between two ldap servers?You really should have one master LDAP server, and slaves for all the remote sites. These slaves will only need to contact the master on machine account change, adding machines etc. Andrew Bartlett -- Andrew Bartlett abartlet@pcug.org.au Manager, Authentication Subsystems, Samba Team abartlet@samba.org Student Network Administrator, Hawker College abartlet@hawkerc.net http://samba.org http://build.samba.org http://hawkerc.net -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 189 bytes Desc: This is a digitally signed message part Url : http://lists.samba.org/archive/samba/attachments/20031112/80188eed/attachment.bin