LDAP-UX Client Services B.05.00 with Microsoft Windows Active Directory Server Administrator's Guide (obsolete beyond B.05.00)

file will have the “local” section immediately followed by the “gc” section. Any remote domain
sections in the file after the "gc" section are remote domains in the forest you configure. They are
only used by LDAP-UX to download profiles from the server, and will be ignored by LDAP-UX for
the multiple domain search scope.
3.5 Resolving duplicate entries
In the Windows 2003 R2 or 2008 environment, a user account can exist in multiple domains.
Each account has a user principal name (UPN) in the format <user>@<DNS-domain-name>.
Users can log on using UPN without choosing a domain. Due to the limitation of the HP-UX operating
system, LDAP-UX does not support UPN as in Windows 2003 R2 or 2008. It is recommended that
you configure a unique user name and uid number in the forest. When the same account exists in
multiple domains, LDAP-UX uses the following rules to return information:
3.5.1 When there are duplicate entries in the local domain
LDAP-UX returns the first entry found.
3.5.2 When there are duplicate entries in remote domains
• If the remote domains are configured, LDAP-UX searches each domain in the configuration
sequence and returns data from the first entry found.
• If only GCS is configured, LDAP-UX returns a NOT_FOUND message.
• If both remote domains and GCS are configured, LDAP-UX searches remote domains first,
and returns the first entry found. If no entry is found in the remote domains, and duplicate
entries are in other domains in the forest, LDAP-UX returns a NOT_FOUND message.
3.5.3 When there are duplicate entries in both local and remote domains
LDAP-UX returns the first entry found in the local domain.
When LDAP-UX returns a NOT_FOUNDmessage, the user cannot log into HP-UX clients. Therefore,
if you want to allow a user in remote domains to log into HP-UX, it is better to have a unique user
name and uid number for each user in the entire forest. Otherwise, be sure that your multiple
domain configuration allows LDAP-UX to return data.
3.5.4 Example
The following example explains what to expect when your user accounts are not unique in the
forest.
Assume the user account jimmy resides in domainA, domainB, and domainC simultaneously:
• If domain A is the local domain, jimmy in domainA will log into HP-UX client.
• If all three domains are remote domains, and are configured in the sequence: domainB,
domainC, domainA, then jimmy in domainB, the first domain in the configuration, will log
into HP-UX client.
• If all three domains are remote domains, and the GCS is selected, then jimmy cannot log
into HP-UX client at all since LDAP-UX cannot distinguish which jimmy is preferred (when
duplicate entries exist for GCS, none is valid).
• If all three domains are remote domains, domainC is included in your remote domain
configuration, and GCS is selected, then jimmy in domainC logs into HP-UX client.
If the user name jimmy is unique in the forest, but the uid number is not unique, jimmy can log
into the HP-UX client, but depending on if the uid number can be returned, he may have problems
changing his password using the passwd command.
3.5 Resolving duplicate entries 67