PMDF System Manager's Guide
37.2 Analyzing Directory Synchronization Needs
It is necessary to examine each directory carefully before any attempt
is made to deploy directory synchronization. A variety of data has to
be obtained, including:
- What value is, or what values are, to be used as the unique entry
identifier or distinguished name for an entry? In an X.500 or
LDAP directory each entry is guaranteed to have a uniquely identifying
name, referred to as the distinguished name. Other directories
can have their own uniquely identifying field, such as the user's
"account" name. Yet other directories can have no single
uniquely identifying field. For directory synchronization, each
directory entry needs to be uniquely identifiable; PMDF-DIRSYNC uses
the LDAP and X.500 term distinguished name for this unique
identifier. (However, note that PMDF-DIRSYNC's distinguished name field
does not need to literally be an X.500 distinguished name.) For
directories whose entries do not have a single uniquely identifying
field, you will have to either add some uniquely identifying field to
that directory's entries, or select a collection of fields that in
combination uniquely identify an entry.
- What values are to be synchronized? Not all data held by one
directory can be held by others, and even if it is possible, it might
not be reasonable to attempt to synchronize pictures and other bulky
data. The directory differencer has mechanisms to filter out extraneous
data, but the rule should be to discard unnecessary data as early in
the sequence as possible, for instance at the cook step. The only time
the differencer should be discarding data is where you have some
feature-rich directories (such as X.500, LDAP, or Lotus Notes), and one
or more feature-poor directories such as cc:Mail.
- What mechanism is to be used to extract and update the directory?
PMDF-DIRSYNC has agents for most of the common directories and has
general tools for assisting in building agents for other directories.
- How are the directory agents to be scheduled? Most agents will
require some external scheduling to run.
- Each directory robot and most directory synchronization robots need
to have their own PMDF channels defined. The only current exception to
this is the Lotus Notes channel, where the LN channel used for e-mail
also acts on directory information.