This document is a cache from http://www.centrify.com/downloads/public/centrify_dc_solution_guide.pdf

Solution Guide: Windows Security and Directory Services for ...

Document source : www.centrify.com

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 All Pages

WINDOWS SECURITY AND DIRECTORY SERVICES FOR UNIX USING CENTRIFY DIRECTCONTROL

PAGE 18

If you have a large UNIX environment, you should consider the number and locations of
your Active Directory domain controllers. Your physical design should address the
domain controllers different sets of UNIX computers should use and whether additional
domain controllers should be added to handle the increased demand from UNIX
computers and users. Planning should be made for addressing network bandwidth and
latency as well as provisions for uninterrupted service in the event of the unplanned
failure of a local domain controller. Since DirectControl supports the caching of user
credentials, users will be able to continue to securely access systems that they have
previously accessed even if the domain controller is not available. This is consistent with
the behavior of a Windows XP system that has been joined to the domain and accessed
by a domain user at least once. This new capability should be taken into consideration
when building the physical design and location of domain controllers.
DirectControl supports the secure exchange of Active Directory credentials in cross
domain trusts and forests with multiple domains. This capability for example will enable
planners to securely share application servers across multiple domains in the
organization with the result of potentially reducing the number of physical servers.
Finally, the DirectControl credential caching capability enables some new potential
scenarios for the physical design of the network. The possibility now exists to have
roaming Linux or UNIX users that are now able to securely log into the domain accounts
on their systems, even if they are not on the same network as the domain controller.
Figure 1.7 is an example of a physical design that leverages DirectControl for providing
security and directory services to UNIX and Linux systems in a multi-domain
environment.

dept.example.com

example.com

WAN / VPN

Windows Client

UNIX/Linux Client

with DirectControl Agent

Centrify Solution

Single Username and Password for

Windows, UNIX and Linux Clients

Transparent Single Sign-On Access to

Windows, UNIX and Linux apps

Windows Server 2003