Modifying Network Group Properties

The network group properties filters the traffic and indicates how a request is directed. To modify the network group properties, use the dsconfig set-network-group-prop command. The network group properties include the properties enabled, associated workflow name, priority, and criteria.

To modify any of the network group properties, use the dsconfig set-network-group-prop command. For example, to modify the priority of the network group:

$ dsconfig -h localhost -p 4444 -D "cn=Directory Manager" -w password -X -n \
  set-network-group-prop \
  --group-name network-group1 \
  --set priority:3

Example 2

Setting the Network Group Criteria

Using the network group properties, you can set the following criteria:

• the authentication method allowed between the client and the network group (allowed-auth-method)

• the bind DN allowed to connect to the network group (allowed-bind-dn)

• the list of clients authorized to access the Sun OpenDS Standard Edition proxy (allowed-client), expressed by the IP address or name of the client . If no allowed client list is provided, then all clients are allowed, assuming they are not listed on the denied client list.

• the protocol allowed to connect to the Sun OpenDS Standard Edition proxy (allowed-protocol). If none is specified, then all protocols are allowed.

• the list of clients not authorized to access the Sun OpenDS Standard Edition proxy (denied-client). If no denied client list is provided, then all clients are authorized, assuming there is no limitation set by an allowed client list.

• if security between the client and the Sun OpenDS Standard Edition proxy is always required (is-security-mandatory)

For example, you can ensure that no connections are accepted from the IP address 208.77.188.166, by network-group1 as follows:

$ dsconfig -h localhost -p 4444 -D "cn=Directory Manager" -w password -X -n \
  set-network-group-prop \
  --group-name network-group1 \
  --set denied-client:208.77.188.166 

To Set an Allowed or Denied Client List

For allowed-client and denied-client lists, you must be aware of the name service configuration on the server. For example, if the name service knows the host as myclienthost.example.com, you must specify myclienthost.example.com as the value, and not just myclienthost. Similarly, if the name service knows the host as myclienthost, you must specify the value as myclienthost. If you do not know how the name service is configured, you should specify both the fully qualified domain name (for example myclienthost.sun.com) and the short name (myclienthost) of the machine. Specifying multiple values will ensure that the name is resolved correctly. For example:

$ dsconfig -h localhost -p 4444 -D "cn=Directory Manager" -w password -X -n \
  set-network-group-prop \
  --group-name network-group1 \
  --set denied-client:myhost \
  --set denied-clieng:myhost.example \
  --set denied-client:myhost.example.com

To avoid any issues, use the IP address for clarity.

Moreover, if you use localhost or the name of the local machine when connecting to Sun OpenDS Standard Edition proxy, the IP addresses of the client will be different. If you want to forbid connections from the localhost to Sun OpenDS Standard Edition proxy, you should specify both localhost and the name of the local machine in the list of denied-clients.