Overview#TreeKey as used for eDirectory are a special kind of NICI SDI Key
In all prior versions of eDirectory a single Security Domain consisting of the whole tree has been established and the associated key is often referred to as the TreeKey or sometimes the W0 key (as the SDI Key object used to manage this key is CN=W0.CN=KAP.CN=Security). This key is a 3DES key, and all the servers in an eDirectory tree have the rights to acquire this key. This key will continue to be available.EDirectory 184.108.40.206 (40002.79) with NICI 3.0 3.0, there are now two TreeKey objects, CN=W0.CN=KAP.CN=Security which manages the older 3DES TreeKey (or the W0 key), and CN=W1.CN=KAP.CN=Security which manages the new AES 256-bit TreeKey (or the W1 key).
The new AES 256-bit TreeKey requires that all servers in the tree be upgraded to EDirectory 220.127.116.11 (40002.79) before enabling this key. Although EDirectory 18.104.22.168 (40002.79) will automatically create this SDI Key object, it will not assign a Key server and the key will not get created by default. An administrator will need to assign a Key server to the SDI key object, after confirming that all servers in the tree have been upgraded to EDirectory 22.214.171.124 (40002.79), in order to enable the new AES 256-bit TreeKey.
Although any server can be configured as a Key server for the TreeKey, it is recommended that only servers holding a ReadWrite replica of the SDI key objects be assigned. It is recommended that the first Key server assigned be the Master replica (for example, the server holding the Master replica of the object CN=W1.CN=KAP.CN=Security).
NICISDI supports having multiple Key servers for any SDI Key and it is recommended that multiple Key servers be assigned. In NICI 3.0 once a Key server has been assigned to the TreeKey objects, the new Heath-Check feature will automatically add servers holding a writeable replica of the SDI key object). The idea here is that NICI SDI will automatically mirror the Key servers to your eDirectory replicas.