LDAP-UX Client Services B.04.15 with Microsoft Windows Active Directory Server Administrator's Guide (edition 8)

PROFILE_ENTRY_DN="cn=globalprofile,CN=Configuration,DC=la,DC=ca,
DC=com"
PROGRAM="/opt/ldapux/config/create_profile_cache -i
/etc/opt/ldapux/domain_profiles/ldapux_profile.ldif.gc -o
/etc/opt/ldapux/domain_profiles/ldapux_profile.bin.gc
The contents of this file are created as you run the setup tool. Therefore, the sequence in this
file represents the sequence in which you create remote domains while running setup, which is
also the sequence that LDAP-UX will connect to domain controllers to perform the search. The
local domain is created first, followed by remote domains, followed by the GCS, then lastly the
domains inside the forest which have not been configured during remote domain configuration.
If you configure remote domains without using the GCS, the file will only include information
for remote domains. If you skip remote domains and just configure GCS, the
ldapux_client.conf file will have the "local" section immediately followed by the "gc" section.
Any remote domain sections in the file after the "gc" section are remote domains in the forest
you configure. They are only used by LDAP-UX to download profiles from the server, and will
be ignored by LDAP-UX for the multiple domain search scope.
Resolving Duplicate Entries
In the Windows 2000 or 2003 environment, a user account can exist in multiple domains. Each
account has a user principal name (UPN) in the format <user>@<DNS-domain-name>. Users
can log on using UPN without choosing a domain. Due to the limitation of the HP-UX operating
system, LDAP-UX does not support UPN as in Windows 2000 or 2003. It is recommended that
you configure a unique user name and uid number in the forest. When the same account exists
in multiple domains, LDAP-UX uses the following rules to return information:
When there are duplicate entries in the local domain
LDAP-UX returns the first entry found.
When there are duplicate entries in remote domains
• If the remote domains are configured, LDAP-UX searches each domain in the configuration
sequence and returns data from the first entry found.
• If only GCS is configured, LDAP-UX returns a NOT_FOUND message.
• If both remote domains and GCS are configured, LDAP-UX searches remote domains first,
and returns the first entry found. If no entry is found in the remote domains, and duplicate
entries are in other domains in the forest, LDAP-UX returns a NOT_FOUND message.
When there are duplicate entries in both local and remote Domains
LDAP-UX returns the first entry found in the local domain.
When LDAP-UX returns a NOT_FOUNDmessage, the user cannot log into HP-UX clients. Therefore,
if you want to allow a user in remote domains to log into HP-UX, it is better to have a unique
user name and uid number for each user in the entire forest. Otherwise, be sure that your multiple
domain configuration allows LDAP-UX to return data.
Example
The following example explains what to expect when your user accounts are not unique in the
forest.
60 Active Directory Multiple Domains