HP CIFS Server 3.0d Administrator's Guide version A.02.02 (Edition 5)

HP CIFS Deployment Models
Samba Domain Model
Chapter 9198
and Windows user accounts on the LDAP directory. The LDAP database
can replace /etc/passwd and smbpasswd, and the PDC can access the
LDAP directory for Windows authentication.
HP CIFS Server Acting as a BDC
The configuration of BDCs is similar to that of the PDC. This enables
BDCs to carry much of the network logon processing. A BDC on a local
segment handles logon requests and authenticates users when the PDC
is busy on the local network. When a segment becomes heavily loaded,
the reponsibility is offloaded to another segment’s BDC or to the PDC.
Therefore, you can optimize resources and add robustness to network
services by deploying BDCs throughout the network.
If you set the local master parameter to yes in smb.conf, browsing
can also be spread throughout the network.
You can promote a BDC to a PDC if the PDC needs to be taken out of
service or fails. To promote a BDC to a PDC, change the domain master
parameter from no to yes.
The PDC and BDCs use the central LDAP directory to store common
POSIX and Windows accounts on the LDAP directory. When you
integrate the HP CIFS Server acting as a BDC with the LDAP directory,
you must install the HP LDAP-UX Integration software and configure
the LDAP-UX client. The BDC can access the LDAP directory for
Windows authentication.
HP CIFS Acting as the Member Server
To ensure that there are always sufficient domain controllers to handle
authentication and logon requests, in general, configure BDCs rather
than member servers unless there are fewer than about 30 Windows
clients per BDC.
You can join an HP CIFS Server to the Samba Domain.The Windows
authentication requests are managed by the PDC or BDCs using LDAP,
smbpasswd or other backend. For detailed information on how to join an
HP CIFS Server to the Samba Domain, see “Domain Member Server” on
page 83 in Chapter 4.
The member server smb.conf configuration differs from that of the PDC
and BDC. You must set the security parameter to domain. This forces
the member server to authenticate via the PDC or BDCs. You must set