Operational behavior

The operational behavior of the HCD LDAP backend is basically the same as that for the RACF backend with some small differences. Information about the RACF Backend can be obtained from the z/OS IBM Tivoli Directory Server Administration and Use for z/OSz/OS IBM Tivoli Directory Server Administration and Use for z/OS.

The following gives an overview of the functional behavior of the HCD LDAP backend:

1. The HCD LDAP backend does not participate in extended group membership searching on a client request.
2. It is possible to run several HCD LDAP backends on one IBM Tivoli Directory Server for z/OS simultaneously.
3. The root of a subtree (see Figure 148) is denoted by a suffix in the configuration file. You can specify only one suffix per HCD LDAP backend. Suffix names must be unique if you are running multiple HCD LDAP backends.
4. The HCD LDAP backend does not support Access Control Lists (ACLs) which are normally used to protect information stored in an LDAP directory from unauthorized access. The reason for this is that the DIT portions managed by the HCD LDAP backend are based on IODF data sets for which all access control is performed by RACF.
5. The HCD LDAP backend does not support the following LDAP request types and will answer these requests with the return code "Unwilling to Perform":
   • Bind
   • ModifyDN (also called ModifyRDN, or ModRdn)
   • Compare
   • Abandon
   • Extended Request
6. The following LDAP request types are supported by the HCD LDAP backend:
   • Add
   • Delete
   • Modify
   • Search
   The following table shows how the HCD LDAP backend behaves during these LDAP operations:

   Target DN	Search	Add	Delete	Modify
   suffix	Error: Inappropriate Matching	Error: Inappropriate Matching	Error: Inappropriate Matching	Error: Inappropriate Matching
   hcdIodfId= IodfDsn,suffix	Perform the appropriate search request. See Search	Error: Inappropriate Matching	Error: Inappropriate Matching	Perform the appropriate modify request. See Modify
   ...,hcdIodfId= IodfDsn,suffix	Perform the appropriate search request. See Search	Perform the appropriate add request. See Add	Perform the appropriate delete request. See Delete	Perform the appropriate modify request. See Modify

7. Multi-server or replication is not supported by the HCD LDAP backend