UCS 2.4 - Univention

2 Domain concept
Contents
2.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
2.2 UCS system roles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
2.2.1 Domain controller master . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
2.2.2 Domain controller backup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
2.2.3 Domain controller slave . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
2.2.4 Member server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
2.2.5 Base system . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
2.2.6 Managed client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
2.2.7 Mobile client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
2.2.8 Thin Client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
2.3 System roles in Windows domains . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
2.3.1 How are these roles integrated in the UCS concept? . . . . . . . . . . . . . . . . . . 18
2.4 Joining domains . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
2.1 Introduction
2.4.1 How UCS systems join domains . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
2.4.2 How to join domains with Windows clients . . . . . . . . . . . . . . . . . . . . . . . . 21
2.4.3 Rotation of machine account passwords . . . . . . . . . . . . . . . . . . . . . . . . . 23
Univention Corporate Server offers a cross platform domain concept with a common trust context between
Linux and/or Windows systems. Within this domain a user is known to all systems via his username and
password stored in the Univention Management System and can use all services which are authorised for
him.
Replication of the directory data within a UCS domain occurs via the Univention Directory Listener/Notifier
mechanism: On the master domain controller the notifier service monitors changes in the LDAP directory
and makes the selected changes available transaction-based to the listener services on the other domain
systems with a copy of the LDAP. Alongside replication of the LDAP contents, the dissemination of the
domain-wide file changes also includes transfer of the changes to LDAP contents in configuration files of
non-LDAP-compatible services (e.g., NFS). The following diagram offers an overview; for more detailed
documentation of the technical processes and the possibilities of the error analysis, please refer to the [2]
technical document.
15