Secure Design - Bindery Context FAQ

QView v2.x Bindery Context FAQ

Setting Bindery Context (from Novell's online documentation about bindery contexts in NW 4.1)

Only objects at the bindery context are available for bindery services. The bindery context should be set in the AUTOEXEC.NCF file on each server, although it can also be set at the server with the SET command.

Each server can support up to 16 containers that comprise the bindery context. Each bindery context is the name of the container where bindery services is available on the server.

In a Single-Level Directory Tree

If the Directory contains only one container level (that is, if the Directory is flat), there is only one possible bindery context. For example, the following figure shows a Directory tree with only one level.

Figure 3-2. Bindery Context in a Flat Directory Tree

In effect, this structure is like a bindery and is not scalable like NDS. Because there is only one container object, the bindery context for the servers can be set to O=ACME, using the following command in the AUTOEXEC.NCF file:

SET BINDERY CONTEXT=ACME.US

Because the user objects are also located within the O=ACME container object, those users can log in to either server under bindery services.

In a Multiple-Level Directory Tree

If the Directory tree hierarchy contains more levels, the bindery context has a more noticeable effect on a user's ability to access bindery services. For example, consider the Directory tree shown in the following figure.

Figure 3-3. Two Different Bindery Contexts in a Directory Tree

This Directory tree has five container objects, each designated by the naming type O or OU:

O=ACME
OU=HQ.O=ACME
OU=HR.OU=HQ.O=ACME
OU=ACCT.OU=HQ.O=ACME
OU=PAY.OU=HQ.O=ACME

This Directory tree also contains two servers, each with its bindery context set as follows:

SET BINDERY CONTEXT=HQ.ACME

SET BINDERY CONTEXT=ACCT.HQ.ACME

For Objects in Different Bindery Contexts

Ideally, all objects a user wants to access under bindery services should be located in the same bindery context. However, this is not always possible or practical.

You can set multiple bindery contexts for users who need to access objects outside of their own bindery contexts. For example, consider the Directory tree in the following figure.

Figure 3-6. Multiple Bindery Contexts in the Same Directory Tree

To set the bindery contexts in this figure to the container OU=HQ where ESAYES and SWILLIAMS can access the objects in the other bindery contexts, you would enter the following command in the server's AUTOEXEC.NCF file where the users are located:

SET BINDERY CONTEXT=ACCT.HQ.ACME;PROD1.DETROIT.MFG.ACME;SALES.ACME;

To set multiple bindery contexts, you must set the contexts to the [Root] of the tree. You can also set multiple bindery contexts with the SET utility. You can set up to 16 contexts per server.

Use a semicolon to separate contexts. For more information, see "SET" in Utilities Reference.

IMPORTANT: Do not change a server's bindery context once you set it. Changing a server's bindery context prevents all bindery services users (from the original context) who need to log in to that server from accessing bindery services.

Changing the server's bindery context can also disable access to print queues

support@sdesign.com