HP-UX Directory Server 8.1 deployment guide

The following sections describe some of the more specific differences between referrals and
chaining in greater detail.
5.3.3.1 Usage differences
Some client applications do not support referrals. Chaining allows client applications to
communicate with a single server and still access the data stored on many servers. Sometimes
referrals do not work when a company's network uses proxies. For example, a client application
may have permissions to communicate with only one server inside a firewall. If that application
is referred to a different server, it is not able to contact it successfully.
A client must also be able to authenticate correctly when using referrals, which means that the
servers to which clients are being referred need to contain the client's credentials. With chaining,
client authentication takes place only once. Clients do not need to authenticate again on the
servers to which their requests are chained.
5.3.3.2 Evaluating access controls
Chaining evaluates access controls differently from referrals. With referrals, an entry for the
client must exist on all the target servers. With chaining, the client entry does not need to be on
all the target servers.
Performing search requests using referrals The following diagram illustrates a client request to
a server using referrals:
Figure 5-11 Sending a client request to a server using referrals
In the illustration above, the client application performs the following steps:
1. The client application first binds with Server A.
2. Server A contains an entry for the client that provides a user name and password, so it
returns a bind acceptance message. In order for the referral to work, the client entry must
be present on server A.
3. The client application sends the operation request to Server A.
4. However, Server A does not contain the requested information. Instead, Server A returns a
referral to the client application instructing it to contact Server B.
5. The client application then sends a bind request to Server B. To bind successfully, Server B
must also contain an entry for the client application.
6. The bind is successful, and the client application can now resubmit its search operation to
Server B.
This approach requires Server B to have a replicated copy of the client's entry from Server A.
68 Designing the directory topology