Safeguard Authentication Services 5.0.2 - Administration Guide

Results

The Results view confirms that the import is complete. If any problems were encountered, the import errors are reported on this view.

Click Save to save the import results to a text file.

Unix account management in large environments

In large Active Directory environments, it is always a challenge to provide optimal performance and functionality. Safeguard Authentication Services provides configuration settings that may help you improve performance in an enterprise deployment.

User and group search paths

Each Unix host running Safeguard Authentication Services builds a persistent cache of user and group information. By default, the cache is built from users and groups in the joined domain. It is possible to change the search base from which the users or groups are loaded by using the group-search-path and user-search-path options. These search paths can either restrict the location from which the users and groups are loaded, or you can specify a search base in an entirely different domain. This is useful in organizations that use resource domains, where computer objects are stored in a separate domain from the domains where users and groups are located.

You can specify a group or user search path using the -g or -u options to the vastool join command. The following command joins the Unix host to the computers.example.com domain, and loads users from the base of the sub.example.com domain:

vastool -u admin join -u DC=sub,DC=example,DC=com computers.example.com 

You can change the default user or group search base at any time by adding the group-search-path and user-search-path options in the [vasd] section of vas.conf and running vastool flush. See the vas.conf man page for an example of user and group search paths.

Minimizing the size of the user cache

By default, Safeguard Authentication Services caches Unix user information for all users in a domain on every machine joined to that domain. An alternate caching method, known as "workstation mode", allows you to limit the size of the user cache by caching user information only for users who log in to a particular workstation. To enable workstation mode, enable the workstation-mode option in vas.conf.

For details, refer to the vas.conf man page. See Using manual pages (man pages) for information about accessing the vas.conf man page.