DIRECTORY SERVICES


The LDAP service and directory tree verification
When the LDAP service starts on the server that is the administration server for the primary IBM® Lotus® Domino® Directory, it displays these messages at the server console:
These messages indicate that the LDAP service is verifying that each part of an IBM® Lotus® Notes®-style distinguished name in a document in the directory has a separate document to define the name part. If the LDAP service detects that a part of a name is missing such a corresponding document, it creates one in a hidden view. Creating an additional document in this way ensures that LDAP clients can always use subtree searches to find the original document.

For example, if the distinguished name in a Person document is Phyllis Spera/Boston/Acme, and there is no Domino Certifier document registered for the organizational unit Boston, the LDAP service creates an organizationalUnit document for Boston. Then, an LDAP user can use a search filter that specifies a search base of "ou=Boston,o=Acme" with the subtree scope to find the entry cn=Phyllis Spera,ou=Boston,o=Acme.

If the server running the LDAP service is the administration server for a Domino Directory or Extended Directory Catalog, the LDAP service can verify the directory tree. The LDAP service does not verify the directory tree for a Configuration Directory or for a condensed Directory Catalog.

The LDAP service can create three types of documents, depending on which part of a Notes distinguished name is missing one: country, organizationalUnit, and organization documents. The LDAP service adds such a document when:


Directory tree verification applies only to the distinguished names of documents are added and visible through Notes, since entries added through the LDAP protocol always have an object class defined for each distinguished name part.

Running directory tree verification manually

You can run directory tree verification manually, for example if you've added documents to a directory since you last started the LDAP service. To run directory tree verification manually, enter this command from the Domino Directory administration server:


Finding the documents that directory tree verification creates

To find the documents created by directory tree verification, use an LDAP client and specify the following search filter:


Related topics