filenet设置双ad域、多ad域、域集群认证

filenet设置双ad域、多ad域、域集群认证


昨天面试问到一个双ad域认证的问题，当时也只是在工作中听过，但没有亲身研究过，现在把结果分享给大家，只是理论研究没有实现过，不过应该是没问题的。


filenet ad域认证方式有single-realm, multi-realm, and entire forest三种。


设置详细说明与原理
http://pic.dhe.ibm.com/infocenter/p8docs/v4r5m1/index.jsp?topic=%2Fcom.ibm.p8.planprepare.doc%2Fp8ppi069.htm
如何设置
http://pic.dhe.ibm.com/infocenter/p8docs/v4r5m1/index.jsp?topic=%2Fcom.ibm.p8.doc%2Fce_help%2Faboutem%2Faem_directory_config_properties_general_tab.htm


实现过程：
1、右击企业管理器中根文件夹，选属性，点Directory Configuration tab.
2、在ad failover（即host属性）设置输入ad servers,格式如下
Hostname1:Port1 Hostname2:Port2 Hostname3:Port3 ... HostnameN:PortN
3、设置Support multiple realms and domains（因为我没有装filenet，也不太清楚这个属性是不是在Directory Configuration tab，大家自己找一下吧。找到的可以回答一下


。） 设置为 No，就是单ad域（single-realm）；Yes就是多ad域（Muti-realm）或ad域集群（entire forest），ad域集群时，还要设置GC failover list（Global Catalog Host 


(Active Directory)）和其port，没有设置就是多ad域（Muti-realm）了。




===============================================================
详细的过程与记录
===============================================================
一是connect to domain是如何的？
二是gc是只用一个ldap备胎？


方案一：如果可以gc用到2个备胎，去到domain是用自己登陆的用户，问题解决。




结论：
1、设置Support multiple realms and domains ====== Yes
2、在ad failover（即host属性）设置2个以上就是multi-realm
3、1后，设置GC failover list（Global Catalog Host (Active Directory)）就是entire forest




---------------------------------------------------------
DirectoryConfigurationAD
your configured domains and realms.
DNS Site==== Yes – Resolve domain controllers in a given DNS site.、




an Active Directory global catalog 与 a directory server区别？
Active Directory Domain Services (AD DS) forest. 


---------------------------------------------------------
Right-click the Enterprise Manager Root Folder, and then click Properties.
Click the Directory Configuration tab.
On the General tab, enter a failover list into the appropriate property. The Host property is for a domain controller failover list, and the Global Catalog 


Host property is for a global catalog failover list.
---------------------------------------------------------
Support multiple realms and domains ====== Yes
---------------------------------------------------------
Restrict to single realm
two realm? a realm a ad?
---------------------------------------------------------
single-realm, multi-realm, and entire forest
---------------------------------------------------------
System Administration > Enterprise-wide Administration > FileNet P8 Security > Directory Service Providers > Windows Active Directory Lightweight Application 


Mode (AD LDS).
---------------------------------------------------------


For a more detailed procedure on how to configure a failover list, see System Administration > Content Engine Administration > FileNet P8 Domain > How to... 


> Configure directory server failover (Microsoft Active Directory).
---------------------------------------------------------


Active Directory consists of two types of repositories:
---------------------------------------------------------
Domain Controllers (DC) that hold domain-wide data
Global Catalog servers (GC) that hold forest-wide data
---------------------------------------------------------
Active Directory Failover ad备胎
Distinguished Name (DN) 
---------------------------------------------------------
如何工作，先到gc取dn，再到domain取信息，有多个，取第一个。
If more than one user is found, Content Engine logs an error and returns the first user found.


upn格式
Microsoft defines the user principal name (UPN) format to consist of the user name, the at sign (@), and a user principal name suffix. In Content Engine, the 


user name part is always the short name, and the suffix part is always the DNS domain name of the domain the user belongs to.


---------------------------------------------------------
IBM FileNet P8 documentation > System Administration > Content Engine Administration > FileNet P8 domain > How to... > View and modify FileNet P8 domain 


properties


---------------------------------------------------------
IBM FileNet P8 documentation > System Administration > Content Engine Administration > FileNet P8 domain > How to...
Associate a FileNet P8 site with an Active Directory Site
You can use Enterprise Manager to associate a FileNet P8 site with an Active Directory Site by setting the Active Directory Site DNS property.
Before performing this procedure, use Active Directory Sites and Services to create a new Active Directory site, and to add any new or existing domain 


controllers to the new site. For more information, see the Microsoft Active Directory documentation.
Update the Active Directory Site DNS property
In Enterprise Manager, right-click the site to be associated with the Active Directory site just created and click Properties.
Click the Properties tab.
Click the push button to the right of the Active Directory Site DNS property value field.
Enter the name of the new Active Directory site that you just created.


---------------------------------------------------------