Single Domain model: there is one domain with accounts and resources. The advantages:
- Works best for small organizations
- Centralized management of users and resources
- No trusts involved
Single Master Domain model : there is one account domain and multiple resource domains with each resource domain trusting the account (user) domain. The advantages of the single master domain are:
- Good solution for moderately sized networks
- Departmental control of resources based on resource domains (departmental, unit, ...)
- Centralized user account management
- Global groups are defined centrally in account domain
The number of trusts:
T = Rthat is, the number of trusts is equal to the number of resource domains, one trust per resource domain where the resource domain trusts the account domain.
Multiple Master Domain model: an extension of the single master domain model. Most appropriate for divisions separated geographically and when one must scale beyond the number of accounts supported in a single account domain. You have multiple single master domains linked together by two way trusts. Each account domain trusts every other account domain. Each resource domain trusts each account domain. The advantages are:
- Good solution for very large organizations
- Scaleable to accommodate any number of users - just add more account domains
- Resources are locally and logically grouped
- Departmental-focused management of resources
- Any master domain could administer all user accounts or not if wished
The number of trusts :
T = M * (M - 1) + R * Mwhere M is number of account masters and R is the number of resource domains. Actually this is the maximum number of trusts. You generally can not avoid the
M * M-1trusts between account domains. One has the
R * Mtrusts only if all resource domains have users needing access in all account domains.
Complete Trust Domain model: a mesh model is a set of single domains with trusts between each domain. Appropriate for early phase of consolidation between small organizations with existing single domains or politically sensitive departmentally organized enterprises with control issues over accounts and resources. The advantages are:
- Useful for organizations with no MIS department
- Scaleable for any number of users
- Each department (entity with a domain) has Full Control over its users and resources
- Users and resources are located within the same domain
- No centralized management
- Many trust relationships to manage
- Administrators must trust each other to properly manage users, groups, and resources
The number of trusts :
T = D * ( D - 1)where D is number of domains.
One sees the term two-way trusts. There are no two way trusts. When domainA trusts domainB
domainA --> domainBdomainA is the trusting domain and domainB is the trusted domain. The relationship is that users in B may be permitted to access resources in A. The resources are in the trusting domain and the users are in the trusted domain. If one needs it to work both way, you need to create another trust going the other way
domainA <-- domainBdomainB is the trusting domain and domainA is the trusted domain. To create a "two-way" trust, you have to create the two one-way trusts. I use the memory aid that the accounts include an account for Ed and that resources are thINGs. Thus the trustED domain, the domain with accounts, is the trustED domain and the trustING domain, the domain with thINGs (resources), is the trustING domain. There is no transitivity in trust relationships: if domainA trusts domainB and domainB trusts domainC, this does not mean that domainA also trusts domainC.
|Multiple Master||unlimited||Centralized in |
M * (M - 1) + R * M
|Complete Trust |
D * ( D - 1)
User Manager for Domains is the tool used to create/delete trusts. To create a trust between domainA and domainB, where domainA is the account domain:
- domain admin of the account domainA starts User Manager for Domains. In the Trust Relationships window, click the Add button next to the display area labeled "Trusting Domains." Type the name of the trusting domain (domainB). User Manager will request a password for the trusting domain.
- domain admin of the resource domainB starts User Manager for Domains. In the Trust Relationships window, click the Add button next to the display area labeled "Trusted Domains." Type the name of the trusted domain (domainA). You will be prompted to enter the password required for the trusting domain to communicated to the trusted domain. The domain admin of the trusted domain would need to give you this password. The trusting domain will create an account which uses this password to communicate with the trusted domain.