Directory Server Configuration

algorithm(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

encryption, algorithm – DS attribute encryption (ETA) properties

Description

Directory Server allows you to encrypt individual attributes to protect sensitive information stored in the directory. The encryption does not prevent client applications from reading the attributes. Instead it works at the database index file level to prevent users with access to read database index files from being able to search through the indexes for sensitive information.

For example, before attribute encryption is configured for uid attributes, a user with read access to database index files could easily find out that bjensen is a uid attribute value:

$ strings example_uid.db3 | grep bjensen =bjensen $

Once uid attributes are encrypted, the job is not so easy:

$ strings example_uid.db3 | grep bjensen $

Notice however that encrypted RDN values are not fully hidden. Instead they appear in clear in the DN index:

$ strings example_entrydn.db3 | grep bjensen =uid=bjensen,ou=people,dc=example,dc=com =uid=bjensen,ou=people,dc=example,dc=com $

PROPERTY: algorithm

Syntax	des|des3|rc2|rc4
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

Directory Server uses a cipher to encrypt a specified attribute in a given suffix. This property specifies the cipher used.

The following property values are supported:

des

DES block cipher

des3

Triple-DES block cipher

rc2

RC2 block cipher

rc4

RC4 stream cipher

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), desc(5dsconf)

ODSEE 11.1.1.3.0  Last Revised June 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

all-ids-threshold(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

all-ids-threshold – Maximum number of values per index key in an index list

Description

Syntax	INTEGER or inherited
Default Value	4000 or inherited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the maximum number of values per index key that the server maintains in an index list. It can be set for an entire server instance, for an entire suffix, and for an individual attribute type. You can also set individual thresholds for equality, presence, and substring indexes.

When you do not set specific threshold values, the values at each level are inherited from the more global values. Thus the default suffix threshold value is inherited from the setting for the server instance; the default attribute type value from the setting for the suffix. In addition to inheritance of default settings, this property handles settings as follows.

inherited

The threshold value is inherited from the more global setting.

<2000

The threshold value is rounded up to 2000.

>2000

The setting is used as a guaranteed minimum threshold. Because of internal mechanisms, the real value can be slightly more than the specified value.

After you modify this property for an entire server instance or an entire suffix, import all data from LDIF to reinitialize all indexes.

If you modify this property only for a specific attribute, it is usually most expedient to use the dsconf reindex command on the attribute for which you changed the threshold. The dsconf reindex command runs a directory task to reindex the attribute while the server instance is online.

The system indexes cannot have the all-ids-threshold property modified for a single attribute type, but for the whole index.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), index(5dsconf), server(5dsconf), suffix(5dsconf)

ODSEE 11.1.1.3.0  Last Revised Jan. 19, 2009

Name | Description | SYNTAX VALUES | Attributes | See Also

all-ids-threshold-eq(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

index, all-ids-threshold-eq, all-ids-threshold-pres, all-ids-threshold-sub, approx-enabled, eq-enabled, matching-rule, pres-enabled, sub-enabled, system – DS attribute indexing (IDX) properties

Description

Directory Server can index attributes, making them faster to search. The dsconf command helps you configure five of the six supported index types:

1. Equality indexes to determine expediently whether an attribute value is equal to a specified value

2. Presence indexes to determine whether a specified attribute has any values

3. Substring indexes to determine whether a specified attribute has values containing a specified string, also used to compare regular expressions to attribute values

4. Approximate indexes, based on metaphone approximation and useful for English language strings only, to determine whether a specified attribute has any values that sound like the specified string

5. International indexes, also called matching rule indexes, to expedite sorting and searching in accordance with the language rules of a particular locale

The dsconf command does not help you configure virtual list view, also known as browsing, indexes.

The dsconf command does help you assign all IDs threshold values to indexes. As the number of entries and attribute values grows in a directory, the number of attribute values to index also grows, as does therefore the size of the indexes. In some deployments a server can end up maintaining index lists so large that the cost of rebuilding an index when attributes are modified or added outweighs the benefit the index provides for searches. All IDs thresholds limit the growth of large indexes by definining the maximum number of entry identifiers Directory Server maintains in an index list. You can define all IDs thresholds for individual indexes and for some types of indexes.

Some indexes are maintained by the server for its own use. These are called system indexes. In general, do not modify or remove systems indexes; such modifications could have severe repercussions on performance.

See Directory Server Indexing in Oracle Fusion Middleware Reference for Oracle Directory Server Enterprise Edition for further details about indexing.

PROPERTY: all-ids-threshold

Syntax	INTEGER | inherited
Default Value	inherited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the maximum number of entry IDs the server maintains in an index list for the specified attribute type. By default its value is inherited from the all-ids-threshold setting for the suffix, whose default value in turn is inherited from the all-ids-threshold setting for the server, which by default is 4000. In addition to inheritance of default settings, this property handles settings as follows:

inherited

The threshold is inherited from the more global setting.

<2000

The threshold value is rounded up to 2000.

>2000

The setting is used as a guaranteed minimum threshold. Because of internal mechanisms, the real value can be slightly more than the specified value.

After you modify this property, reindex the attribute for which you changed the threshold. For example:

$ dsconf set-index-prop dc=example,dc=com uid all-ids-threshold:5000 $ dsconf reindex -t uid dc=example,dc=com ## example: Indexing attribute: uid ## example: Finished indexing. Task completed (slapd exit code: 0). $

PROPERTY: all-ids-threshold-eq

Syntax	INTEGER | inherited
Default Value	inherited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the all IDs threshold for equality indexes of the specified attribute. By default its value is inherited from the all-ids-threshold setting for the attribute type. See all-ids-threshold(5dsconf) for more information.

PROPERTY: all-ids-threshold-pres

Syntax	INTEGER | inherited
Default Value	inherited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the all IDs threshold for presence indexes of the specified attribute. By default its value is inherited from the all-ids-threshold setting for the attribute type. See all-ids-threshold(5dsconf) for more information.

PROPERTY: all-ids-threshold-sub

Syntax	INTEGER | inherited
Default Value	inherited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the all IDs threshold for substring indexes of the specified attribute. By default its value is inherited from the all-ids-threshold setting for the attribute type. See all-ids-threshold(5dsconf) for more information.

PROPERTY: approx-enabled

Syntax	on|off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether approximate indexes are maintained for the specified attribute type. You cannot set an all IDs threshold value for approximate indexes.

PROPERTY: desc

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

Use this optional property to provide a short description of the index configuration.

PROPERTY: eq-enabled

Syntax	on|off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether equality indexes are maintained for the specified attribute type.

PROPERTY: matching-rule

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the matching rule indexes maintained for the specified attribute type.

Values for this property must be valid collation order object identifiers (OIDs). See Directory Server Internationalized Directory in Directory Server Enterprise Edition Reference for the OIDs corresponding to supported locales.

PROPERTY: pres-enabled

Syntax	on|off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether presence indexes are maintained for the specified attribute type.

PROPERTY: sub-enabled

Syntax	on|off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether substring indexes are maintained for the specified attribute type.

PROPERTY: system

Syntax	true|false
Default Value	false
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property identifies whether the specified index is a system index, and therefore should be left alone.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), desc(5dsconf)

ODSEE 11.1.1.3.0  Last Revised June 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

all-ids-threshold-pres(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

index, all-ids-threshold-eq, all-ids-threshold-pres, all-ids-threshold-sub, approx-enabled, eq-enabled, matching-rule, pres-enabled, sub-enabled, system – DS attribute indexing (IDX) properties

Description

Directory Server can index attributes, making them faster to search. The dsconf command helps you configure five of the six supported index types:

1. Equality indexes to determine expediently whether an attribute value is equal to a specified value

2. Presence indexes to determine whether a specified attribute has any values

3. Substring indexes to determine whether a specified attribute has values containing a specified string, also used to compare regular expressions to attribute values

4. Approximate indexes, based on metaphone approximation and useful for English language strings only, to determine whether a specified attribute has any values that sound like the specified string

5. International indexes, also called matching rule indexes, to expedite sorting and searching in accordance with the language rules of a particular locale

The dsconf command does not help you configure virtual list view, also known as browsing, indexes.

The dsconf command does help you assign all IDs threshold values to indexes. As the number of entries and attribute values grows in a directory, the number of attribute values to index also grows, as does therefore the size of the indexes. In some deployments a server can end up maintaining index lists so large that the cost of rebuilding an index when attributes are modified or added outweighs the benefit the index provides for searches. All IDs thresholds limit the growth of large indexes by definining the maximum number of entry identifiers Directory Server maintains in an index list. You can define all IDs thresholds for individual indexes and for some types of indexes.

Some indexes are maintained by the server for its own use. These are called system indexes. In general, do not modify or remove systems indexes; such modifications could have severe repercussions on performance.

See Directory Server Indexing in Oracle Fusion Middleware Reference for Oracle Directory Server Enterprise Edition for further details about indexing.

PROPERTY: all-ids-threshold

Syntax	INTEGER | inherited
Default Value	inherited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the maximum number of entry IDs the server maintains in an index list for the specified attribute type. By default its value is inherited from the all-ids-threshold setting for the suffix, whose default value in turn is inherited from the all-ids-threshold setting for the server, which by default is 4000. In addition to inheritance of default settings, this property handles settings as follows:

inherited

The threshold is inherited from the more global setting.

<2000

The threshold value is rounded up to 2000.

>2000

The setting is used as a guaranteed minimum threshold. Because of internal mechanisms, the real value can be slightly more than the specified value.

After you modify this property, reindex the attribute for which you changed the threshold. For example:

$ dsconf set-index-prop dc=example,dc=com uid all-ids-threshold:5000 $ dsconf reindex -t uid dc=example,dc=com ## example: Indexing attribute: uid ## example: Finished indexing. Task completed (slapd exit code: 0). $

PROPERTY: all-ids-threshold-eq

Syntax	INTEGER | inherited
Default Value	inherited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the all IDs threshold for equality indexes of the specified attribute. By default its value is inherited from the all-ids-threshold setting for the attribute type. See all-ids-threshold(5dsconf) for more information.

PROPERTY: all-ids-threshold-pres

Syntax	INTEGER | inherited
Default Value	inherited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the all IDs threshold for presence indexes of the specified attribute. By default its value is inherited from the all-ids-threshold setting for the attribute type. See all-ids-threshold(5dsconf) for more information.

PROPERTY: all-ids-threshold-sub

Syntax	INTEGER | inherited
Default Value	inherited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the all IDs threshold for substring indexes of the specified attribute. By default its value is inherited from the all-ids-threshold setting for the attribute type. See all-ids-threshold(5dsconf) for more information.

PROPERTY: approx-enabled

Syntax	on|off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether approximate indexes are maintained for the specified attribute type. You cannot set an all IDs threshold value for approximate indexes.

PROPERTY: desc

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

Use this optional property to provide a short description of the index configuration.

PROPERTY: eq-enabled

Syntax	on|off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether equality indexes are maintained for the specified attribute type.

PROPERTY: matching-rule

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the matching rule indexes maintained for the specified attribute type.

Values for this property must be valid collation order object identifiers (OIDs). See Directory Server Internationalized Directory in Directory Server Enterprise Edition Reference for the OIDs corresponding to supported locales.

PROPERTY: pres-enabled

Syntax	on|off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether presence indexes are maintained for the specified attribute type.

PROPERTY: sub-enabled

Syntax	on|off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether substring indexes are maintained for the specified attribute type.

PROPERTY: system

Syntax	true|false
Default Value	false
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property identifies whether the specified index is a system index, and therefore should be left alone.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), desc(5dsconf)

ODSEE 11.1.1.3.0  Last Revised June 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

all-ids-threshold-sub(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

index, all-ids-threshold-eq, all-ids-threshold-pres, all-ids-threshold-sub, approx-enabled, eq-enabled, matching-rule, pres-enabled, sub-enabled, system – DS attribute indexing (IDX) properties

Description

Directory Server can index attributes, making them faster to search. The dsconf command helps you configure five of the six supported index types:

1. Equality indexes to determine expediently whether an attribute value is equal to a specified value

2. Presence indexes to determine whether a specified attribute has any values

3. Substring indexes to determine whether a specified attribute has values containing a specified string, also used to compare regular expressions to attribute values

4. Approximate indexes, based on metaphone approximation and useful for English language strings only, to determine whether a specified attribute has any values that sound like the specified string

5. International indexes, also called matching rule indexes, to expedite sorting and searching in accordance with the language rules of a particular locale

The dsconf command does not help you configure virtual list view, also known as browsing, indexes.

The dsconf command does help you assign all IDs threshold values to indexes. As the number of entries and attribute values grows in a directory, the number of attribute values to index also grows, as does therefore the size of the indexes. In some deployments a server can end up maintaining index lists so large that the cost of rebuilding an index when attributes are modified or added outweighs the benefit the index provides for searches. All IDs thresholds limit the growth of large indexes by definining the maximum number of entry identifiers Directory Server maintains in an index list. You can define all IDs thresholds for individual indexes and for some types of indexes.

Some indexes are maintained by the server for its own use. These are called system indexes. In general, do not modify or remove systems indexes; such modifications could have severe repercussions on performance.

See Directory Server Indexing in Oracle Fusion Middleware Reference for Oracle Directory Server Enterprise Edition for further details about indexing.

PROPERTY: all-ids-threshold

Syntax	INTEGER | inherited
Default Value	inherited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the maximum number of entry IDs the server maintains in an index list for the specified attribute type. By default its value is inherited from the all-ids-threshold setting for the suffix, whose default value in turn is inherited from the all-ids-threshold setting for the server, which by default is 4000. In addition to inheritance of default settings, this property handles settings as follows:

inherited

The threshold is inherited from the more global setting.

<2000

The threshold value is rounded up to 2000.

>2000

The setting is used as a guaranteed minimum threshold. Because of internal mechanisms, the real value can be slightly more than the specified value.

After you modify this property, reindex the attribute for which you changed the threshold. For example:

$ dsconf set-index-prop dc=example,dc=com uid all-ids-threshold:5000 $ dsconf reindex -t uid dc=example,dc=com ## example: Indexing attribute: uid ## example: Finished indexing. Task completed (slapd exit code: 0). $

PROPERTY: all-ids-threshold-eq

Syntax	INTEGER | inherited
Default Value	inherited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the all IDs threshold for equality indexes of the specified attribute. By default its value is inherited from the all-ids-threshold setting for the attribute type. See all-ids-threshold(5dsconf) for more information.

PROPERTY: all-ids-threshold-pres

Syntax	INTEGER | inherited
Default Value	inherited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the all IDs threshold for presence indexes of the specified attribute. By default its value is inherited from the all-ids-threshold setting for the attribute type. See all-ids-threshold(5dsconf) for more information.

PROPERTY: all-ids-threshold-sub

Syntax	INTEGER | inherited
Default Value	inherited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the all IDs threshold for substring indexes of the specified attribute. By default its value is inherited from the all-ids-threshold setting for the attribute type. See all-ids-threshold(5dsconf) for more information.

PROPERTY: approx-enabled

Syntax	on|off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether approximate indexes are maintained for the specified attribute type. You cannot set an all IDs threshold value for approximate indexes.

PROPERTY: desc

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

Use this optional property to provide a short description of the index configuration.

PROPERTY: eq-enabled

Syntax	on|off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether equality indexes are maintained for the specified attribute type.

PROPERTY: matching-rule

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the matching rule indexes maintained for the specified attribute type.

Values for this property must be valid collation order object identifiers (OIDs). See Directory Server Internationalized Directory in Directory Server Enterprise Edition Reference for the OIDs corresponding to supported locales.

PROPERTY: pres-enabled

Syntax	on|off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether presence indexes are maintained for the specified attribute type.

PROPERTY: sub-enabled

Syntax	on|off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether substring indexes are maintained for the specified attribute type.

PROPERTY: system

Syntax	true|false
Default Value	false
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property identifies whether the specified index is a system index, and therefore should be left alone.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), desc(5dsconf)

ODSEE 11.1.1.3.0  Last Revised June 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

approx-enabled(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

index, all-ids-threshold-eq, all-ids-threshold-pres, all-ids-threshold-sub, approx-enabled, eq-enabled, matching-rule, pres-enabled, sub-enabled, system – DS attribute indexing (IDX) properties

Description

Directory Server can index attributes, making them faster to search. The dsconf command helps you configure five of the six supported index types:

1. Equality indexes to determine expediently whether an attribute value is equal to a specified value

2. Presence indexes to determine whether a specified attribute has any values

3. Substring indexes to determine whether a specified attribute has values containing a specified string, also used to compare regular expressions to attribute values

4. Approximate indexes, based on metaphone approximation and useful for English language strings only, to determine whether a specified attribute has any values that sound like the specified string

5. International indexes, also called matching rule indexes, to expedite sorting and searching in accordance with the language rules of a particular locale

The dsconf command does not help you configure virtual list view, also known as browsing, indexes.

The dsconf command does help you assign all IDs threshold values to indexes. As the number of entries and attribute values grows in a directory, the number of attribute values to index also grows, as does therefore the size of the indexes. In some deployments a server can end up maintaining index lists so large that the cost of rebuilding an index when attributes are modified or added outweighs the benefit the index provides for searches. All IDs thresholds limit the growth of large indexes by definining the maximum number of entry identifiers Directory Server maintains in an index list. You can define all IDs thresholds for individual indexes and for some types of indexes.

Some indexes are maintained by the server for its own use. These are called system indexes. In general, do not modify or remove systems indexes; such modifications could have severe repercussions on performance.

See Directory Server Indexing in Oracle Fusion Middleware Reference for Oracle Directory Server Enterprise Edition for further details about indexing.

PROPERTY: all-ids-threshold

Syntax	INTEGER | inherited
Default Value	inherited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the maximum number of entry IDs the server maintains in an index list for the specified attribute type. By default its value is inherited from the all-ids-threshold setting for the suffix, whose default value in turn is inherited from the all-ids-threshold setting for the server, which by default is 4000. In addition to inheritance of default settings, this property handles settings as follows:

inherited

The threshold is inherited from the more global setting.

<2000

The threshold value is rounded up to 2000.

>2000

The setting is used as a guaranteed minimum threshold. Because of internal mechanisms, the real value can be slightly more than the specified value.

After you modify this property, reindex the attribute for which you changed the threshold. For example:

$ dsconf set-index-prop dc=example,dc=com uid all-ids-threshold:5000 $ dsconf reindex -t uid dc=example,dc=com ## example: Indexing attribute: uid ## example: Finished indexing. Task completed (slapd exit code: 0). $

PROPERTY: all-ids-threshold-eq

Syntax	INTEGER | inherited
Default Value	inherited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the all IDs threshold for equality indexes of the specified attribute. By default its value is inherited from the all-ids-threshold setting for the attribute type. See all-ids-threshold(5dsconf) for more information.

PROPERTY: all-ids-threshold-pres

Syntax	INTEGER | inherited
Default Value	inherited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the all IDs threshold for presence indexes of the specified attribute. By default its value is inherited from the all-ids-threshold setting for the attribute type. See all-ids-threshold(5dsconf) for more information.

PROPERTY: all-ids-threshold-sub

Syntax	INTEGER | inherited
Default Value	inherited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the all IDs threshold for substring indexes of the specified attribute. By default its value is inherited from the all-ids-threshold setting for the attribute type. See all-ids-threshold(5dsconf) for more information.

PROPERTY: approx-enabled

Syntax	on|off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether approximate indexes are maintained for the specified attribute type. You cannot set an all IDs threshold value for approximate indexes.

PROPERTY: desc

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

Use this optional property to provide a short description of the index configuration.

PROPERTY: eq-enabled

Syntax	on|off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether equality indexes are maintained for the specified attribute type.

PROPERTY: matching-rule

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the matching rule indexes maintained for the specified attribute type.

Values for this property must be valid collation order object identifiers (OIDs). See Directory Server Internationalized Directory in Directory Server Enterprise Edition Reference for the OIDs corresponding to supported locales.

PROPERTY: pres-enabled

Syntax	on|off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether presence indexes are maintained for the specified attribute type.

PROPERTY: sub-enabled

Syntax	on|off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether substring indexes are maintained for the specified attribute type.

PROPERTY: system

Syntax	true|false
Default Value	false
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property identifies whether the specified index is a system index, and therefore should be left alone.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), desc(5dsconf)

ODSEE 11.1.1.3.0  Last Revised June 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

argument(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

plugin, argument, depends-on-named, depends-on-type, feature, init-func, lib-path, type, vendor, version – DS plug-in configuration (PLG) properties

Description

Directory Server implements some key functionality as plug-ins. Plug-ins take the form of libraries loaded when the server starts, and called at different points in the processing of client application requests. When you create custom plug-ins, you must configure the server to load and use them, then restart Directory Server to load the newly configured plug-ins.

PROPERTY: argument

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies arguments passed to the plug-in when it is loaded by Directory Server. Arguments are passed in the order you specify them. Updating the list of arguments replaces all the existing arguments previously specified when the plug-in is loaded again.

PROPERTY: depends-on-named

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies names of plug-ins that must be available and loaded before Directory Server loads the current plug-in.

PROPERTY: depends-on-type

Syntax	STRING (See the description that follows.)
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies types of plug-ins that must be available and loaded before Directory Server loads the current plug-in. The value must be the value of a plug-in type property.

PROPERTY: feature

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the plug-in identifier from the Slapi_PluginDesc structure.

PROPERTY: init-func

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of function called by Directory Server to initialize the plug-in.

PROPERTY: lib-path

Syntax	PATH
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the absolute file system path to the library containing plug-in.

PROPERTY: type

Syntax	STRING (See the description that follows.)
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the plug-in type. The following plug-in types are supported.

ldbmentryfetchstore

Entry store and fetch plug-in

extendedop

Extended operation plug-in

passwordcheck

Password check plug-in

postoperation

Post-operation plug-in

preoperation

Pre-operation plug-in

internalpostoperation

Internal post-operation plug-in

internalpreoperation

Internal pre-operation plug-in

matchingrule

Matching rule plug-in for extensible match search filters

object

Generic plug-in type, sometimes used to register other plug-ins

passwordcheck

Strong password check plug-in

pwdstoragescheme

Password storage scheme plug-in

PROPERTY: vendor

Syntax	STRING
Default Value	Vendor name in plug-in configuration
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the plug-in vendor from the Slapi_PluginDesc structure.

PROPERTY: version

Syntax	STRING
Default Value	Version string in plug-in configuration
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the plug-in version from the Slapi_PluginDesc structure.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Stable

See Also

dsconf(1M), desc(5dsconf), enabled(5dsconf)

ODSEE 11.1.1.3.0  Last Revised June 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

attr(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

repl-priority, attr, base-dn, bind-dn, op-type – DS prioritized replication configuration (RPR) properties

Description

Prioritized replication lets you force a Directory Server supplier to assign higher priority to certain updates replicated on a Directory Server consumer. You prioritize replication operations by creating replication priority rules.

PROPERTY: attr

Syntax	ATTR_NAME
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the attribute type to which the replication priority rule applies.

PROPERTY: base-dn

Syntax	DN
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the DN under which the replication priority rule applies. For example, if you set base-dn:ou=administrators,dc=example,dc=com, then changes to uid=myAdmin,ou=administrators,dc=example,dc=com might be replicated with high priority, but changes to uid=bjensen,ou=people,dc=example,dc=com would not.

PROPERTY: bind-dn

Syntax	DN
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a bind DN for an account whose updates might be replicated with high priority.

PROPERTY: op-type

Syntax	add | mod | del
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a type of operation for which updates might be replicated with high priority.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M)

ODSEE 11.1.1.3.0  Last Revised June 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

auth-bind-dn(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

repl-agmt, auth-bind-dn, auth-protocol, auth-pwd, repl-fractional-exclude-attr, repl-fractional-include-attr, repl-schedule, transport-compression, transport-group-size, transport-window-size – DS replication agreement configuration (RAG) properties

Description

A replication agreement governs how a Directory Server supplier updates a Directory Server consumer. Although this configuration element is called an agreement, it concerns the configuration only of the supplier.

PROPERTY: auth-bind-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the bind DN used by the supplier to bind to the consumer in order to perform replication-related updates. This bind DN must be present on the consumer.

PROPERTY: auth-protocol

Syntax	clear|ssl-simple|ssl-client
Default Value	clear
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the protocol used by the supplier to bind to the consumer in order to perform replication-related updates. The default is to bind with simple authentication in clear text without securing the connection, as most replications connections are made on an internal network. You may however configure replication to use SSL and simple authentication to protect the connection from malicious snooping, or SSL with client authentication to further protect the connection.

PROPERTY: auth-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password used by the supplier to bind to the consumer. You provide it using auth-pwd-file.

PROPERTY: auth-pwd-file

Syntax	PATH
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the bind password for replication is read to create the replication agreement. The file is read once on replication agreement creation, and the password is stored for future use.

PROPERTY: repl-fractional-exclude-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the list of attributes not to replicate. This property is mutually exclusive with repl-fractional-include-attr.

PROPERTY: repl-fractional-include-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the list of attributes to replicate. This property is mutually exclusive with repl-fractional-exclude-attr.

PROPERTY: repl-schedule

Syntax	INTERVAL | always
Default Value	always
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the times and days when replication can take place.

PROPERTY: transport-compression

Syntax	best-compression | best-speed | default-compression | no-compression
Default Value	no-compression
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the level of libz(3) compression used on replication updates from the supplier to the consumer. Supported settings are as follows.

no-compression

No compression

default-compression

Default zlib compression (zlib numeric value = -1)

best-speed

Fastest zlib compression (zlib numeric value = 1)

best-compression

Strongest zlib compression (zlib numeric value = 9)

If the bottleneck for replication in your environment is network bandwidth, this property can potentially help you tune the replication protocol for better performance.

PROPERTY: transport-group-size

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many replication messages are grouped on the supplier before being sent to the consumer. Valid range is 1 to 255.

If the bottleneck for replication in your environment is network bandwidth, this property can potentially help you tune the replication protocol for better performance.

PROPERTY: transport-window-size

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of replication messages sent from the supplier to the consumer before waiting for a response from the consumer to continue. Valid range is 1 to 65535.

If the bottleneck for replication in your environment is network latency or network bandwidth, this property can potentially help you tune the replication protocol for better performance.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), desc(5dsconf), enabled(5dsconf)

ODSEE 11.1.1.3.0  Last Revised June 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

auth-protocol(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

repl-agmt, auth-bind-dn, auth-protocol, auth-pwd, repl-fractional-exclude-attr, repl-fractional-include-attr, repl-schedule, transport-compression, transport-group-size, transport-window-size – DS replication agreement configuration (RAG) properties

Description

A replication agreement governs how a Directory Server supplier updates a Directory Server consumer. Although this configuration element is called an agreement, it concerns the configuration only of the supplier.

PROPERTY: auth-bind-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the bind DN used by the supplier to bind to the consumer in order to perform replication-related updates. This bind DN must be present on the consumer.

PROPERTY: auth-protocol

Syntax	clear|ssl-simple|ssl-client
Default Value	clear
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the protocol used by the supplier to bind to the consumer in order to perform replication-related updates. The default is to bind with simple authentication in clear text without securing the connection, as most replications connections are made on an internal network. You may however configure replication to use SSL and simple authentication to protect the connection from malicious snooping, or SSL with client authentication to further protect the connection.

PROPERTY: auth-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password used by the supplier to bind to the consumer. You provide it using auth-pwd-file.

PROPERTY: auth-pwd-file

Syntax	PATH
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the bind password for replication is read to create the replication agreement. The file is read once on replication agreement creation, and the password is stored for future use.

PROPERTY: repl-fractional-exclude-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the list of attributes not to replicate. This property is mutually exclusive with repl-fractional-include-attr.

PROPERTY: repl-fractional-include-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the list of attributes to replicate. This property is mutually exclusive with repl-fractional-exclude-attr.

PROPERTY: repl-schedule

Syntax	INTERVAL | always
Default Value	always
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the times and days when replication can take place.

PROPERTY: transport-compression

Syntax	best-compression | best-speed | default-compression | no-compression
Default Value	no-compression
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the level of libz(3) compression used on replication updates from the supplier to the consumer. Supported settings are as follows.

no-compression

No compression

default-compression

Default zlib compression (zlib numeric value = -1)

best-speed

Fastest zlib compression (zlib numeric value = 1)

best-compression

Strongest zlib compression (zlib numeric value = 9)

If the bottleneck for replication in your environment is network bandwidth, this property can potentially help you tune the replication protocol for better performance.

PROPERTY: transport-group-size

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many replication messages are grouped on the supplier before being sent to the consumer. Valid range is 1 to 255.

If the bottleneck for replication in your environment is network bandwidth, this property can potentially help you tune the replication protocol for better performance.

PROPERTY: transport-window-size

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of replication messages sent from the supplier to the consumer before waiting for a response from the consumer to continue. Valid range is 1 to 65535.

If the bottleneck for replication in your environment is network latency or network bandwidth, this property can potentially help you tune the replication protocol for better performance.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), desc(5dsconf), enabled(5dsconf)

ODSEE 11.1.1.3.0  Last Revised June 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

auth-pwd(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

repl-agmt, auth-bind-dn, auth-protocol, auth-pwd, repl-fractional-exclude-attr, repl-fractional-include-attr, repl-schedule, transport-compression, transport-group-size, transport-window-size – DS replication agreement configuration (RAG) properties

Description

A replication agreement governs how a Directory Server supplier updates a Directory Server consumer. Although this configuration element is called an agreement, it concerns the configuration only of the supplier.

PROPERTY: auth-bind-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the bind DN used by the supplier to bind to the consumer in order to perform replication-related updates. This bind DN must be present on the consumer.

PROPERTY: auth-protocol

Syntax	clear|ssl-simple|ssl-client
Default Value	clear
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the protocol used by the supplier to bind to the consumer in order to perform replication-related updates. The default is to bind with simple authentication in clear text without securing the connection, as most replications connections are made on an internal network. You may however configure replication to use SSL and simple authentication to protect the connection from malicious snooping, or SSL with client authentication to further protect the connection.

PROPERTY: auth-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password used by the supplier to bind to the consumer. You provide it using auth-pwd-file.

PROPERTY: auth-pwd-file

Syntax	PATH
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the bind password for replication is read to create the replication agreement. The file is read once on replication agreement creation, and the password is stored for future use.

PROPERTY: repl-fractional-exclude-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the list of attributes not to replicate. This property is mutually exclusive with repl-fractional-include-attr.

PROPERTY: repl-fractional-include-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the list of attributes to replicate. This property is mutually exclusive with repl-fractional-exclude-attr.

PROPERTY: repl-schedule

Syntax	INTERVAL | always
Default Value	always
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the times and days when replication can take place.

PROPERTY: transport-compression

Syntax	best-compression | best-speed | default-compression | no-compression
Default Value	no-compression
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the level of libz(3) compression used on replication updates from the supplier to the consumer. Supported settings are as follows.

no-compression

No compression

default-compression

Default zlib compression (zlib numeric value = -1)

best-speed

Fastest zlib compression (zlib numeric value = 1)

best-compression

Strongest zlib compression (zlib numeric value = 9)

If the bottleneck for replication in your environment is network bandwidth, this property can potentially help you tune the replication protocol for better performance.

PROPERTY: transport-group-size

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many replication messages are grouped on the supplier before being sent to the consumer. Valid range is 1 to 255.

If the bottleneck for replication in your environment is network bandwidth, this property can potentially help you tune the replication protocol for better performance.

PROPERTY: transport-window-size

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of replication messages sent from the supplier to the consumer before waiting for a response from the consumer to continue. Valid range is 1 to 65535.

If the bottleneck for replication in your environment is network latency or network bandwidth, this property can potentially help you tune the replication protocol for better performance.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), desc(5dsconf), enabled(5dsconf)

ODSEE 11.1.1.3.0  Last Revised June 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

base-dn(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

repl-priority, attr, base-dn, bind-dn, op-type – DS prioritized replication configuration (RPR) properties

Description

Prioritized replication lets you force a Directory Server supplier to assign higher priority to certain updates replicated on a Directory Server consumer. You prioritize replication operations by creating replication priority rules.

PROPERTY: attr

Syntax	ATTR_NAME
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the attribute type to which the replication priority rule applies.

PROPERTY: base-dn

Syntax	DN
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the DN under which the replication priority rule applies. For example, if you set base-dn:ou=administrators,dc=example,dc=com, then changes to uid=myAdmin,ou=administrators,dc=example,dc=com might be replicated with high priority, but changes to uid=bjensen,ou=people,dc=example,dc=com would not.

PROPERTY: bind-dn

Syntax	DN
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a bind DN for an account whose updates might be replicated with high priority.

PROPERTY: op-type

Syntax	add | mod | del
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a type of operation for which updates might be replicated with high priority.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M)

ODSEE 11.1.1.3.0  Last Revised June 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

bind-dn(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

repl-priority, attr, base-dn, bind-dn, op-type – DS prioritized replication configuration (RPR) properties

Description

Prioritized replication lets you force a Directory Server supplier to assign higher priority to certain updates replicated on a Directory Server consumer. You prioritize replication operations by creating replication priority rules.

PROPERTY: attr

Syntax	ATTR_NAME
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the attribute type to which the replication priority rule applies.

PROPERTY: base-dn

Syntax	DN
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the DN under which the replication priority rule applies. For example, if you set base-dn:ou=administrators,dc=example,dc=com, then changes to uid=myAdmin,ou=administrators,dc=example,dc=com might be replicated with high priority, but changes to uid=bjensen,ou=people,dc=example,dc=com would not.

PROPERTY: bind-dn

Syntax	DN
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a bind DN for an account whose updates might be replicated with high priority.

PROPERTY: op-type

Syntax	add | mod | del
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a type of operation for which updates might be replicated with high priority.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M)

ODSEE 11.1.1.3.0  Last Revised June 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

buffering-enabled(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

log, buffering-enabled, level, max-age, max-disk-space-size, max-file-count, max-size, min-free-disk-space-size, path, perm, rotation-interval, rotation-min-file-size, rotation-time, verbose-enabled – DS logging configuration (LOG) properties

Description

Directory Server writes to three main types of log files you can configure, the INSTANCE_PATH/logs/access, INSTANCE_PATH/logs/audit, and INSTANCE_PATH/logs/errors logs, where INSTANCE_PATH is the full path where the server instance is located, such as /local/dsInst.

When you specify one of these properties with dsconf get-log-prop or dsconf set-log-prop, you must specify which type of log configuration, access, audit, or error, you want to examine. For example, to see whether audit logging is enabled for a server instance:

$ dsconf get-log-prop audit enabled enabled : off $

PROPERTY: buffering-enabled

Syntax	on | off
Default Value	on for access, not applicable to audit and errors logs
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property indicates whether Directory Server writes access log entries directly to disk, or use a buffer, by default.

PROPERTY: enabled

Syntax	on | off
Default Value	on for access, off for audit, on for errors
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property indicates whether the specified log type is enabled.

PROPERTY: level

Syntax	See the description that follows.
Default Value	default
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property defines which kinds of messages get logged. This property is applicable only to access and errors logs.

access log levels

The following settings are supported:

acc-internal

Log access information for internal operations.

default

Log client access to entries.

acc-default_plus_referrals

As default, but also log access to referrals.

acc-timing

Use precise timing for microsecond resolution of elapsed times.

errors log levels

The following settings are supported:

default

Log startup, shutdown, errors, and warnings.

err-function-calls

Log when server enters or exits a function.

err-search-args

Log search arguments.

err-connection

Connection management.

err-packets

Log packets sent and received.

err-search-filter

Log search filter information.

err-config-file

Log information for changes to the configuration file dse.ldif.

err-acl

Log access control processing information.

err-ldbm

Log information from the ldbm database plugin.

err-entry-parsing

Log LDIF parsing errors.

err-housekeeping

Log event queue information.

err-replication

Log information about replication operations.

err-entry-cache

Log entry cache information.

err-plugins

Log information from server plug-ins.

err-dsml

Log information from DSML front end.

err-dsml-advanced

Debugging information for DSML.

PROPERTY: max-age

Syntax	DURATION | unlimited
Default Value	1M (one month)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the age beyond which the specified type of log file is deleted.

PROPERTY: max-disk-space-size

Syntax	MEMORY_SIZE | unlimited
Default Value	500M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the maximum disk space the specified type of log is allowed to consume. When the limit is reached, the server deletes the oldest log file to reclaim disk space.

PROPERTY: max-file-count

Syntax	Integer
Default Value	10 for access, 2 for errors, 1 for audit
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the maximum number of log files, including rotated logs, of the specified type that the server allows to be created in the log file directory. When the limit is reached, the server deletes the oldest log file to reclaim disk space.

When you set this property to 1, the specified log is not rotated.

PROPERTY: max-size

Syntax	MEMORY_SIZE | unlimited
Default Value	100M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the maximum file size for the specified log. When the limit is reached, the server rotates the log file, unless max-file-count is set to 1.

PROPERTY: min-free-disk-space-size

Syntax	MEMORY_SIZE
Default Value	5M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the minimum free space allowed on the disk where the specified log is stored. When the limit is reached, the server deletes the oldest log files until enough space is available.

PROPERTY: path

Syntax	PATH
Default Value	INSTANCE_PATH/logs/access, INSTANCE_PATH/logs/audit, INSTANCE_PATH/logs/errors
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the full path to the specified log file type.

PROPERTY: perm

Syntax	OCTAL_MODE
Default Value	600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the read, write, and execute permissions on the specified log file.

PROPERTY: rotation-interval

Syntax	DURATION | unlimited
Default Value	1d (one day) for access, 1w (one week) for audit and errors
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the duration between rotations of the specified log file.

PROPERTY: rotation-min-file-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the minimum size the specified log file must have before the server rotates it.

PROPERTY: rotation-time

Syntax	TIME | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the time of day when the server rotates the specified log file.

PROPERTY: verbose-enabled

Syntax	on|off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether extra informational messages are written to the errors log.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), enabled(5dsconf)

ODSEE 11.1.1.3.0  Last Revised April 12, 2007

Name | Description | SYNTAX VALUES | Attributes | See Also

check-schema-enabled(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

check-syntax-enabled(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

compat-flag(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

compressed-entries(5dsconf)

Name | Description | Attributes | See Also

Name

compressed-entries – Entry eligibility for compression

Description

Defines entry eligibility for compression.

Valid values	all and overflow
Default value	overflow
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No
Restart needed	No

• overflow — Only entries in overflow pages will be compressed.

• all — All the entries will be compressed.

Entries are compressed based on the value of compression-mode.

---

Example 1 Setting compressed-entries using the set-suffix-prop subcommand.




$ dsconf set-suffix-prop —p port-number dc=example,dc=com compressed-entries:all

---

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M)

compression-mode(5dsconf)

ODSEE 11.1.1.3.0  Last Revised August 6, 2008

Name | Description | Attributes | See Also

compression-mode(5dsconf)

Name | Description | Attributes | See Also

Name

compression-mode – how entries are compressed

Description

Defines how entries are compressed.

Valid values	none and DSZ
Default value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No
Restart needed	No

• none — No entries compression mechanism will be used.

• DSZ — Entries will be compressed using the DSZ method.

Entries compressed are defined by compressed-entries.

---

Example 1 Setting compression-mode using the set-suffix-prop subcommand.




$ dsconf set-suffix-prop —p port-number dc=example,dc=com compression-mode:DSZ

---

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M)

compressed-entries(5dsconf)

ODSEE 11.1.1.3.0  Last Revised August 6, 2008

Name | Description | Attributes | See Also

config-magic-number(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

controls(5dsconf)

Name | Description

Name

controls – LDAP controls handled by Directory Server

Description

LDAPv3 controls specify extension information sent as part of a request. An explanation of what an LDAPv3 control is can be found in RFC 2251.

Directory Server handles the LDAP controls listed here according to their interface stability. See attributes(5) for descriptions of interface stability.

INTERFACE STABILITY: STANDARD

1.2.840.113556.1.4.473

Server-side sort request, described in RFC 2891

2.16.840.1.113730.3.4.2

Manage DSA IT control, described in RFC 3296

2.16.840.1.113730.3.4.15

Authorization bind identity response control, described in RFC 3829

2.16.840.1.113730.3.4.16

Authorization bind identity request control, described in RFC 3829

2.16.840.1.113730.3.4.18

Proxied authorization (version 2) control, described in RFC 4370.

INTERFACE STABILITY: EXTERNAL

1.3.6.1.4.1.42.2.27.8.5.1

Password policy control

2.16.840.1.113730.3.4.3

Persistent search control

2.16.840.1.113730.3.4.9

Virtual list view request control

INTERFACE STABILITY: STABLE

1.3.6.1.4.1.42.2.27.9.5.2

Get effective rights request control

1.3.6.1.4.1.42.2.27.9.5.8

Account usability control

2.16.840.1.113730.3.4.4

Password expired notification control

2.16.840.1.113730.3.4.5

Password expiring notification control

2.16.840.1.113730.3.4.14

Specific backend search request control

2.16.840.1.113730.3.4.17

Real attributes only request control

2.16.840.1.113730.3.4.19

Virtual attributes only request control

INTERFACE STABILITY: PRIVATE

1.3.6.1.4.1.1466.29539.12

Chained request control

1.3.6.1.4.1.42.2.27.9.5.6

Directory Server initialization control

2.16.840.1.113730.3.4.13

Replication update information control

INTERFACE STABILITY: DEPRECATED

The following control is scheduled for removal.

2.16.840.1.113730.3.4.12

Proxied authorization (version 1) control

ODSEE 11.1.1.3.0  Last Revised March 1, 2010

Name | Description

db-batched-transaction-count(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

db-cache-size(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

db-checkpoint-interval(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

db-env-path(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

db-lock-count(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

db-log-buf-size(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

db-log-path(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

db-name(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

suffix, db-name, entry-cache-count, entry-cache-size, entry-count, index-filter-analyzer-enabled, index-filter-analyzer-max-entries, parent-suffix-dn, referral-mode, repl-accept-client-update-enabled, repl-cl-max-age, repl-cl-max-entry-count, repl-id, repl-manager-bind-dn, repl-purge-delay, repl-rewrite-referrals-enabled, repl-role, require-index-enabled – DS suffix configuration (SUF) properties

Description

Each Directory Server suffix you create is configured according to the suffix properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: db-name

Syntax	STRING
Default Value	suffixName
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the suffix that is used to process requests involving the database.

PROPERTY: db-path

Syntax	PATH
Default Value	server-instance-dir/db/suffix-dir
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the absolute path to the suffix database.

PROPERTY: entry-cache-count

Syntax	INTEGER | unlimited
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of entries allowed in the entry cache of the suffix.

PROPERTY: entry-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum amount of memory Directory Server requests for the entry cache of the suffix.

PROPERTY: entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the number of entries stored in the suffix.

PROPERTY: index-filter-analyzer-enabled

Syntax	off and on
Default Value	off
Is readable	Yes
Is modifiable	No
Is multi-valued	No
Restart needed	No

This property specifies whether the index filter analyzer is running.

PROPERTY: index-filter-analyzer-max-entries

Syntax	Integer
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No
Restart needed	No

This property specifies the maximum number of entries that the index filter analyzer may contain.

PROPERTY: parent-suffix-dn

Syntax	DN | undefined
Default Value	DN of the parent entry
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the DN of the parent entry for the suffix. The value of this property must logically be a parent of the suffix.

For instance, if you have a suffix with DN dc=com and a suffix dc=example,dc=com, you can set dc=com as the parent-suffix-dn of dc=example,dc=com, and subtree searches with based DN dc=com then also travers dc=example,dc=com.

PROPERTY: referral-mode

Syntax	disabled | enabled | only-on-write
Default Value	disabled
Is readable	Yes
Is modifiable	Yes, if the suffix is not replicated
Is multi-valued	No

This property specifies how referrals are used when a client makes a request involving the suffix.

disabled

Handle requests locally; do not return referral URLs.

enabled

Return referral URLs to client requests.

only-on-write

Return referral URLs to client requests only for write operations.

PROPERTY: repl-accept-client-update-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the replicated suffix accepts write operations from client applications, or instead returns referral URLs.

PROPERTY: repl-cl-max-age

Syntax	DURATION | undefined
Default Value	7d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age for a record in the replication changelog. Older records are purged.

PROPERTY: repl-cl-max-entry-count

Syntax	INTEGER
Default Value	0 (meaning undefined)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the replication changelog. When the limit is exceeded, older records are purged.

PROPERTY: repl-id

Syntax	INTEGER
Default Value	None
Is readable	Yes
Is modifiable	Yes, using the subcommands to manage replication
Is multi-valued	No

This property specifies the replica identification number, 1-65534 for a supplier, 65535 for a consumer or a hub. Once set, this property cannot be modified.

PROPERTY: repl-manager-bind-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the bind DNs of users allowed to bind to perform replication operations on the suffix.

PROPERTY: repl-purge-delay

Syntax	DURATION | never
Default Value	7d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of tombstone entries used by replication. Tombstone entries are entries marked for deletion that have not yet been removed, and also replication state information associated with the entries. When setting this attribute, ensure that the purge delay is longer than the longest replication cycle in your replication policy to avoid incurring conflict resolution problems and divergence between replicas.

PROPERTY: repl-rewrite-referrals-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referrals you set can be automatically overwritten by the server to reference replicas.

PROPERTY: repl-role

Syntax	not-replicated | master | hub | consumer
Default Value	not-replicated
Is readable	Yes
Is modifiable	Yes, using the subcommands to manage replication
Is multi-valued	No

This property specifies the role played by the suffix in a replicated topology.

not-replicated

The suffix is not part of a replicated toplogy.

master

This suffix is a supplier of replication updates in a replicated topology. It can accept both read and write operations.

hub

This suffix is a supplier of replication updates in a replicated topology. It can accept read operations and replication updates.

consumer

This suffix is a dedicated consumer of replication updates in a replicated topology. It can accept read operations and replication updates, but not writes from clients.

To promote a replica, use the dsconf promote-repl command. To demote a replica, use the dsconf demote-repl command.

PROPERTY: require-index-enabled

Syntax	on|off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether unindexed searches are allowed. When on, unindexed searches return LDAP_UNWILLING_TO_PERFORM.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), enabled(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

db-path(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

db-path – Path to Directory Server database files

Description

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	No (server instance level), Yes (suffix level)
Is multi-valued	No

This property specifies the default file system directory containing the server database files.

This property is modifiable at the suffix level. At server instance level, the property is set when the server instance is created, and cannot be modified.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), server(5dsconf), suffix(5dsconf)

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | SYNTAX VALUES | Attributes | See Also

def-repl-manager-pwd(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

def-repl-manager-pwd-file(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

depends-on-named(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

plugin, argument, depends-on-named, depends-on-type, feature, init-func, lib-path, type, vendor, version – DS plug-in configuration (PLG) properties

Description

Directory Server implements some key functionality as plug-ins. Plug-ins take the form of libraries loaded when the server starts, and called at different points in the processing of client application requests. When you create custom plug-ins, you must configure the server to load and use them, then restart Directory Server to load the newly configured plug-ins.

PROPERTY: argument

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies arguments passed to the plug-in when it is loaded by Directory Server. Arguments are passed in the order you specify them. Updating the list of arguments replaces all the existing arguments previously specified when the plug-in is loaded again.

PROPERTY: depends-on-named

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies names of plug-ins that must be available and loaded before Directory Server loads the current plug-in.

PROPERTY: depends-on-type

Syntax	STRING (See the description that follows.)
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies types of plug-ins that must be available and loaded before Directory Server loads the current plug-in. The value must be the value of a plug-in type property.

PROPERTY: feature

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the plug-in identifier from the Slapi_PluginDesc structure.

PROPERTY: init-func

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of function called by Directory Server to initialize the plug-in.

PROPERTY: lib-path

Syntax	PATH
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the absolute file system path to the library containing plug-in.

PROPERTY: type

Syntax	STRING (See the description that follows.)
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the plug-in type. The following plug-in types are supported.

ldbmentryfetchstore

Entry store and fetch plug-in

extendedop

Extended operation plug-in

passwordcheck

Password check plug-in

postoperation

Post-operation plug-in

preoperation

Pre-operation plug-in

internalpostoperation

Internal post-operation plug-in

internalpreoperation

Internal pre-operation plug-in

matchingrule

Matching rule plug-in for extensible match search filters

object

Generic plug-in type, sometimes used to register other plug-ins

passwordcheck

Strong password check plug-in

pwdstoragescheme

Password storage scheme plug-in

PROPERTY: vendor

Syntax	STRING
Default Value	Vendor name in plug-in configuration
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the plug-in vendor from the Slapi_PluginDesc structure.

PROPERTY: version

Syntax	STRING
Default Value	Version string in plug-in configuration
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the plug-in version from the Slapi_PluginDesc structure.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Stable

See Also

dsconf(1M), desc(5dsconf), enabled(5dsconf)

ODSEE 11.1.1.3.0  Last Revised June 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

depends-on-type(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

plugin, argument, depends-on-named, depends-on-type, feature, init-func, lib-path, type, vendor, version – DS plug-in configuration (PLG) properties

Description

Directory Server implements some key functionality as plug-ins. Plug-ins take the form of libraries loaded when the server starts, and called at different points in the processing of client application requests. When you create custom plug-ins, you must configure the server to load and use them, then restart Directory Server to load the newly configured plug-ins.

PROPERTY: argument

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies arguments passed to the plug-in when it is loaded by Directory Server. Arguments are passed in the order you specify them. Updating the list of arguments replaces all the existing arguments previously specified when the plug-in is loaded again.

PROPERTY: depends-on-named

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies names of plug-ins that must be available and loaded before Directory Server loads the current plug-in.

PROPERTY: depends-on-type

Syntax	STRING (See the description that follows.)
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies types of plug-ins that must be available and loaded before Directory Server loads the current plug-in. The value must be the value of a plug-in type property.

PROPERTY: feature

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the plug-in identifier from the Slapi_PluginDesc structure.

PROPERTY: init-func

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of function called by Directory Server to initialize the plug-in.

PROPERTY: lib-path

Syntax	PATH
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the absolute file system path to the library containing plug-in.

PROPERTY: type

Syntax	STRING (See the description that follows.)
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the plug-in type. The following plug-in types are supported.

ldbmentryfetchstore

Entry store and fetch plug-in

extendedop

Extended operation plug-in

passwordcheck

Password check plug-in

postoperation

Post-operation plug-in

preoperation

Pre-operation plug-in

internalpostoperation

Internal post-operation plug-in

internalpreoperation

Internal pre-operation plug-in

matchingrule

Matching rule plug-in for extensible match search filters

object

Generic plug-in type, sometimes used to register other plug-ins

passwordcheck

Strong password check plug-in

pwdstoragescheme

Password storage scheme plug-in

PROPERTY: vendor

Syntax	STRING
Default Value	Vendor name in plug-in configuration
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the plug-in vendor from the Slapi_PluginDesc structure.

PROPERTY: version

Syntax	STRING
Default Value	Version string in plug-in configuration
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the plug-in version from the Slapi_PluginDesc structure.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Stable

See Also

dsconf(1M), desc(5dsconf), enabled(5dsconf)

ODSEE 11.1.1.3.0  Last Revised June 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

desc(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

desc – Optional description of configuration element

Description

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

Use this optional property to provide a short description of the configuration element.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), encryption(5dsconf), index(5dsconf), plugin(5dsconf), repl-agmt(5dsconf)

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | SYNTAX VALUES | Attributes | See Also

dn-cache-count(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

dn-cache-size(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

ds5AgreementEnable(5dsconf)

Name | Description | Examples | Attributes | See Also

Name

ds5AgreementEnable – Whether replication is enabled

Description

PROPERTY	VALUE
Entry DN	cn=agreement name,cn=replica,cn=suffix name,cn=mapping tree,cn=config
Valid Range	on | off
Default Value	on
Syntax	DirectoryString

This attribute is part of replica configuration for nsDS5ReplicationAgreement entries.

Specifies whether the replication agreement is enabled.

Examples

ds5AgreementEnable: on

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

replication(5dsconf)

ODSEE 11.1.1.3.0  Last Revised March 1, 2010

Name | Description | Examples | Attributes | See Also

ds5BeginReplicaAcceptUpdates(5dsconf)

Name | Description | Examples | Attributes | See Also

Name

ds5BeginReplicaAcceptUpdates – Accept, rather than refer, update operations

Description

PROPERTY	VALUE
Entry DN	cn=replica,cn=suffix name,cn=mapping tree,cn=config
Valid Range	start|stop
Default Value	None
Syntax	DirectoryString

This attribute is part of replica configuration for nsDS5Replica entries.

When this attribute is set to start, the server accepts client updates rather than referring them to another server.

Examples

ds5BeginReplicaAcceptUpdates: start

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

replication(5dsconf)

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Examples | Attributes | See Also

ds5LastInitTimeStamp(5dsconf)

Name | Description | Examples | Attributes | See Also

Name

ds5LastInitTimeStamp – Time stamp for last initialization

Description

PROPERTY	VALUE
Entry DN	cn=replica,cn=suffix name,cn=mapping tree,cn=config
Valid Range	N/A
Default Value	N/A
Syntax	Integer

This attribute is part of replica configuration for nsDS5Replica entries.

This attribute is reserved for internal use.

Examples

ds5LastInitTimeStamp: 0

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

replication(5dsconf)

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Examples | Attributes | See Also

ds5ReferralDelayAfterInit(5dsconf)

Name | Description | Examples | Attributes | See Also

Name

ds5ReferralDelayAfterInit – Accept update operations after the specified delay

Description

PROPERTY	VALUE
Entry DN	cn=replica,cn=suffix name,cn=mapping tree,cn=config
Valid Range	0 to any 64-bit integer (seconds)
Default Value	Not set (unlimited)
Syntax	Integer

This attribute is part of replica configuration for nsDS5Replica entries.

When this attribute is set, the server starts accepting client updates after waiting the number of seconds you specify.

Examples

ds5ReferralDelayAfterInit: 100

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

replication(5dsconf)

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Examples | Attributes | See Also

ds5ReplicaAutomaticInit(5dsconf)

Name | Description | Examples | Attributes | See Also

Name

ds5ReplicaAutomaticInit – Automatically initialize dedicated consumer

Description

PROPERTY	VALUE
Entry DN	cn=agreement name,cn=replica,cn=suffix name,cn=mapping tree,cn=config
Valid Range	on | off
Default Value	N/A
Syntax	DirectoryString

This attribute is part of replica configuration for nsDS5ReplicationAgreement entries.

When set to on, this attribute causes the server to perform a total update of the consumer replica as soon as replication fails to proceed normally. Use this attribute only in agreements toward read-only, dedicated consumer replica.

Examples

ds5ReplicaAutomaticInit: on

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

replication(5dsconf)

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Examples | Attributes | See Also

ds5ReplicaConsumerTimeout(5dsconf)

Name | Description | Examples | Attributes | See Also

Name

ds5ReplicaConsumerTimeout – Timeout for replication operations

Description

PROPERTY	VALUE
Entry DN	cn=replica,cn=suffix name,cn=mapping tree,cn=config
Valid Range	0 maximum integer (seconds)
Default Value	300 (seconds)
Syntax	Integer

This attribute is part of replica configuration for nsDS5Replica entries.

When set, this attribute causes the consumer to close a replication connection with the current supplier, allowing it to open a replication session with another supplier.

This attribute takes effect under the following conditions on the consumer.

• The supplier sending updates on the current replication session connection has been idle for ds5ReplicaConsumerTimeout seconds.

• No local operation on the consumer is currently replaying updates from the current supplier.

• Another supplier is currently attempting to start a replication session.

Examples

---

Note –

Do not change the value of this attribute unless requested to do so by qualified support personnel.

---

ds5ReplicaConsumerTimeout: 300

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

replication(5dsconf)

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Examples | Attributes | See Also

ds5ReplicaTransportCompressionLevel(5dsconf)

Name | Description | Examples | Attributes | See Also

Name

ds5ReplicaTransportCompressionLevel – Compression used for replication

Description

PROPERTY	VALUE
Entry DN	cn=agreement name,cn=replica,cn=suffix name,cn=mapping tree,cn=config
Valid Range	0 | 1 | 2 | 3
Default Value	0
Syntax	Integer

This attribute is part of replica configuration for nsDS5ReplicationAgreement entries.

Specifies the type of compression used for replication protocol messages.

This attribute takes the following values:

0

No compression

1

Default zlib compression (zlib numeric value = -1)

2

Fastest zlib compression (zlib numeric value = 1)

3

Strongest zlib compression (zlib numeric value = 9)

If the bottleneck for replication in your environment is network bandwidth, this attribute can potentially help you tune the replication protocol for better performance.

Examples

ds5ReplicaTransportCompressionLevel: 2

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

replication(5dsconf)

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Examples | Attributes | See Also

ds5ReplicaTransportConcurrencyLevel(5dsconf)

Name | Description | Examples | Attributes | See Also

Name

ds5ReplicaTransportConcurrencyLevel – Throttle replication concurrency

Description

PROPERTY	VALUE
Entry DN	cn=agreement name,cn=replica,cn=suffix name,cn=mapping tree,cn=config
Valid Range	0 | 1 | 2
Default Value	2
Syntax	Integer

This attribute is part of replica configuration for nsDS5ReplicationAgreement entries.

This attribute lets you force the supplier to replay replicated updates on the consumer in the order they occurred on the supplier, or even by a single thread so that the replayed updates happen sequentially. The following values are supported:

0

Replay updates in sequential order using a single thread. This can reduce throughput.

1

Replay updates in sequential order using multiple threads. This can still reduce throughput compared to the default behavior.

2

(Default) Replay unrelated updates in parallel to increase throughput.

Avoid tweaking this attribute as in most cases all you will manage to do is reduce replication performance.

Examples

ds5ReplicaTransportConcurrencyLevel: 2

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

replication(5dsconf)

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Examples | Attributes | See Also

ds5ReplicaTransportGroupSize(5dsconf)

Name | Description | Examples | Attributes | See Also

Name

ds5ReplicaTransportGroupSize – Grouping size for replication updates

Description

PROPERTY	VALUE
Entry DN	cn=agreement name,cn=replica,cn=suffix name,cn=mapping tree,cn=config
Valid Range	1 to 255
Default Value	1
Syntax	Integer

This attribute is part of replica configuration for nsDS5ReplicationAgreement entries.

When this attribute is set, the supplier groups updates, for an incremental update, or entries, for total update, before sending those updates or entries to the consumer.

If the bottleneck for replication in your environment is network bandwidth, this attribute can potentially help you tune the replication protocol for better performance.

Examples

ds5ReplicaTransportGroupSize: 10

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

replication(5dsconf)

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Examples | Attributes | See Also

ds5ReplicaTransportGrpPktSize(5dsconf)

Name | Description | Attributes | See Also

Name

ds5ReplicaTransportGrpPktSize – Effective group packet size

Description

PROPERTY	VALUE
Entry DN	cn=agreement name,cn=replica,cn=suffix name,cn=mapping tree,cn=config
Valid Range	0 to 65536
Default Value	N/A
Syntax	Integer

This attribute is part of replica configuration for nsDS5ReplicationAgreement entries.

This attribute governs the effective packet size sent by the supplier such that maximum BER size is not exceeded on the consumer.

Do not modify this attribute unless told to do so by qualified support personnel.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

replication(5dsconf)

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Attributes | See Also

ds5ReplicaTransportWindowSize(5dsconf)

Name | Description | Examples | Attributes | See Also

Name

ds5ReplicaTransportWindowSize – Window size for replication updates

Description

PROPERTY	VALUE
Entry DN	cn=agreement name,cn=replica,cn=suffix name,cn=mapping tree,cn=config
Valid Range	1 to 65535
Default Value	10
Syntax	Integer

This attribute is part of replica configuration for nsDS5ReplicationAgreement entries.

The supplier sends up to the specified number of replication messages to the consumer before waiting for a response from the consumer to continue.

If the bottleneck for replication in your environment is network latency or network bandwidth, this attribute can potentially help you tune the replication protocol for better performance.

Examples

ds5ReplicaTransportWindowSize: 100

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

replication(5dsconf)

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Examples | Attributes | See Also

ds6ruv(5dsconf)

Name | Description | Attributes | See Also

Name

ds6ruv – Replication update vector, for version 6 and above

Description

PROPERTY	VALUE
Entry DN	cn=agreement name,cn=replica,cn=suffix name,cn=mapping tree,cn=config
Valid Range	N/A
Default Value	N/A
Syntax	DirectoryString

This attribute is part of replica configuration for nsDS5ReplicationAgreement entries.

This attribute is responsible for managing the internal state of the replica via the replication update vector. It is always present and must not be changed.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

replication(5dsconf)

ODSEE 11.1.1.3.0  Last Revised March 1, 2010

Name | Description | Attributes | See Also

dsChangelogMaxAge(5dsconf)

Name | Description | Examples | See Also | Attributes

Name

dsChangelogMaxAge – Maximum age of change log entries

Description

PROPERTY	VALUE
Entry DN	cn=replica,cn=suffix name,cn=mapping tree,cn=config
Valid Range	See the description that follows.
Default Value	7d (one week)
Syntax	IntegerTimeUnit

This attribute is part of replica configuration for nsDS5Replica entries.

The change log contains a record for each directory modification and is used when synchronizing consumer servers. Each record contains a timestamp. Any record with a timestamp that is older than the value specified in this attribute is removed.

When this attribute is set, the server purges change log entries older than the time you specify. Age is specified as a number followed by a letter s for seconds, m for minutes, h for hours, d for days, or w for weeks. If this attribute is set to 0, entries are not removed according to their age. If this attribute is not present, the default age limit on change log records is one week (7d).

Examples

dsChangelogMaxAge: 7d

See Also

replication(5dsconf)

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Examples | See Also | Attributes

dsChangelogMaxentries(5dsconf)

Name | Description | Examples | Attributes | See Also

Name

dsChangelogMaxentries – Maximum number of change log records

Description

PROPERTY	VALUE
Entry DN	cn=replica,cn=suffix name,cn=mapping tree,cn=config
Valid Range	-1 to maximum integer
Default Value	-1 (unlimited)
Syntax	Integer

This attribute is part of replica configuration for nsDS5Replica entries.

The change log contains a record for each directory modification and is used when synchronizing consumer servers. Each record contains a timestamp. Any record with a timestamp that is older than the value specified in this attribute is removed.

When this attribute is set, the server purges entries from the change log after the maximum you specify is reached. If this attribute is absent, or if it is set to -1, the server does no limit the number of entries in the change log.

Examples

dsChangelogMaxentries: 5000

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

replication(5dsconf)

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Examples | Attributes | See Also

dsFilterSPConfigchecksum(5dsconf)

Name | Description | Examples | Attributes | See Also

Name

dsFilterSPConfigchecksum – Checksum for partial replication

Description

PROPERTY	VALUE
Entry DN	cn=agreement name,cn=replica,cn=suffix name,cn=mapping tree,cn=config (supplier), cn=replica,cn=suffix name,cn=mapping tree,cn=config (consumer)
Valid Range	N/A
Default Value	N/A
Syntax	DirectoryString

This attribute is part of replica configuration for nsDS5Replica and nsDS5ReplicationAgreement entries.

This read-only attribute is reserved for internal use. Do not modify its value.

Examples

dsFilterSPConfigchecksum: 0

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

replication(5dsconf)

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Examples | Attributes | See Also

ds-hdsml-clientauthmethod(5dsconf)

Name | Description | Attributes | See Also

Name

ds-hdsml-clientauthmethod – DSML SSL client authentication

Description

Defines how the server will identify a client on a secure (SSL) connection.

Entry DN

cn=DSMLv2-SOAP-HTTP,cn=frontends,cn=plugins, cn=config

Valid Range

clientCertOnly: the server uses the credentials from the client certificate to identify the client.

httpBasicOnly: the server uses the credentials from the HTTP authorization header to identify the client.

clientCertFirst: the server attempts to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

Default Value

clientCertFirst

Syntax

DirectoryString

Example

ds-hdsml-clientauthmethod: clientCertFirst

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 6, 2006

Name | Description | Attributes | See Also

ds-hdsml-dsmlschemalocation(5dsconf)

Name | Description | Attributes | See Also

Name

ds-hdsml-dsmlschemalocation – DSMLv2 schema location

Description

The path to the DSMLv2 schema. This is generated automatically and should not be changed.

Entry DN

cn=DSMLv2-SOAP-HTTP,cn=frontends,cn=plugins, cn=config

Valid Range

Any valid path to the directory storing the DSML schema.

Default Value

instance-path/plugins/DSMLv2.xsd

Syntax

DirectoryString

Example

ds-hdsml-dsmlschemalocation: /local/dsInstance/plugins/DSMLv2.xsd

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 6, 2006

Name | Description | Attributes | See Also

ds-hdsml-iobuffersize(5dsconf)

Name | Description | Attributes | See Also

Name

ds-hdsml-iobuffersize – buffer size for DSML requests

Description

The size of the buffer in which the DSML request is stored. If Directory Server receives many large DSML requests, such as large modify requests, then increasing this value may allow fewer buffers to be passed from the HTTP front end to the DSML parsers.

Entry DN

cn=DSMLv2-SOAP-HTTP,cn=frontends,cn=plugins, cn=config

Valid Range

1 to an appropriate upper limit for your deployment, with a maximum of 2147483647 (2^31-1). The value must be a multiple of 256.

Default Value

8192

Syntax

Integer

Example

ds-hdsml-buffersize: 8192

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 6, 2006

Name | Description | Attributes | See Also

ds-hdsml-poolmaxsize(5dsconf)

Name | Description | Attributes | See Also

Name

ds-hdsml-poolmaxsize – maximum number of DSML parsers

Description

The maximum number of DSML parsers kept ready to handle DSML requests. If you expect sustained traffic of many concurrent DSML requests, you may choose to increase the value of this attribute.

Entry DN

cn=DSMLv2-SOAP-HTTP,cn=frontends, cn=plugins,cn=config

Valid Range

1 to an appropriate upper limit for your deployment, with a maximum of 2147483647 (2³¹-1).

Default Value

10

Syntax

Integer

Example

ds-hdsml-poolmaxsize: 10

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 6, 2006

Name | Description | Attributes | See Also

ds-hdsml-poolsize(5dsconf)

Name | Description | Attributes | See Also

Name

ds-hdsml-poolsize – default number of DSML parsers

Description

The minimum, default number of DSML parsers kept ready to handle DSML requests. If you expect sustained traffic of many concurrent DSML requests, you may choose to increase the value of this attribute.

Entry DN

cn=DSMLv2-SOAP-HTTP,cn=frontends,cn=plugins, cn=config

Valid Range

1 to an appropriate upper limit for your deployment, with a maximum of 2147483647 (2³¹-1).

Default Value

5

Syntax

Integer

Example

ds-hdsml-poolsize: 5

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 6, 2006

Name | Description | Attributes | See Also

ds-hdsml-port(5dsconf)

Name | Description | Attributes | See Also

Name

ds-hdsml-port – DSML port number

Description

The HTTP port used for DSML communications. The selected port must be unique on the host system; make sure no other application is attempting to use the same port number. Specifying a port number of less than 1024 requires Directory Server to run as super user.

You must restart the server for a port number change to be taken into account.

Entry DN

cn=DSMLv2-SOAP-HTTP,cn=frontends,cn=plugins, cn=config

Valid Range

1-65535

Default Value

disabled

Syntax

Integer

Example

ds-hdsml-port: 8080

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 6, 2006

Name | Description | Attributes | See Also

ds-hdsml-requestmaxsize(5dsconf)

Name | Description | Attributes | See Also

Name

ds-hdsml-requestmaxsize – maximum DSML request size

Description

The maximum size of a DSML request. If the request is larger than this value, the server responds with the error message REQUEST_ENTITY_TOO_LARGE and closes the connection to prevent the client from continuing the request.

Entry DN

cn=DSMLv2-SOAP-HTTP,cn=frontends,cn=plugins, cn=config

Valid Range

1-2147483647 (2³¹-1)

Default Value

32768

Syntax

Integer

Example

ds-hdsml-requestmaxsize: 32768

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 6, 2006

Name | Description | Attributes | See Also

ds-hdsml-responsemsgsize(5dsconf)

Name | Description | Attributes | See Also

Name

ds-hdsml-responsemsgsize – maximum size of DSML response

Description

The maximum size of a server response to a DSML request, or a fraction of the maximum response size in the case of intermediate search responses. If the response is larger than the size specified here.

Entry DN

cn=DSMLv2-SOAP-HTTP,cn=frontends,cn=plugins, cn=config

Valid Range

1-2147483647 (2^31-1)

Default Value

65536

Syntax

Integer

Example

ds-hdsml-responsemsgsize: 65536

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 6, 2006

Name | Description | Attributes | See Also

ds-hdsml-rooturl(5dsconf)

Name | Description | Attributes | See Also

Name

ds-hdsml-rooturl – root URL for DSML

Description

The root URL used in the HTTP POST request to indicate the request is DSML. On the client side, this corresponds to the first line of the post, such as:

POST /dsml HTTP/1.1

Client applications must post to the value of this attribute.

Entry DN

cn=DSMLv2-SOAP-HTTP,cn=frontends,cn=plugins, cn=config

Valid Range

Any valid URL.

Default Value

/dsml

Syntax

DirectoryString

Example

ds-hdsml-rooturl: /dsml

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 6, 2006

Name | Description | Attributes | See Also

ds-hdsml-secureport(5dsconf)

Name | Description | Attributes | See Also

Name

ds-hdsml-secureport – DSML SSL port number

Description

The port number used for secure DSML communications (over SSL). The selected port must be unique on the host system; make sure no other application is attempting to use the same port number. Specifying a port number of less than 1024 requires Directory Server to run as super user.

You must restart the server for a port number change to be taken into account.

Entry DN

cn=DSMLv2-SOAP-HTTP,cn=frontends,cn=plugins, cn=config

Valid Range

1-65535

Default Value

None

Syntax

Integer

Example

ds-hdsml-secureport: 1443

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 6, 2006

Name | Description | Attributes | See Also

ds-hdsml-soapschemalocation(5dsconf)

Name | Description | Attributes | See Also

Name

ds-hdsml-soapschemalocation – SOAP schema location for DSML

Description

The path to the SOAP schema. This is generated automatically and should not be changed.

Entry DN

cn=DSMLv2-SOAP-HTTP,cn=frontends,cn=plugins, cn=config

Valid Range

Any valid path to the directory storing the SOAP schema.

Default Value

instance-path/plugins/soap-env.xsd

Syntax

DirectoryString

Example

ds-hdsml-soapschemalocation: /local/dsInstance/plugins/soap-env.xsd

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 6, 2006

Name | Description | Attributes | See Also

ds-maxheaphigh(5dsconf)

Name | Description | Attributes | See Also

Name

ds-maxheaphigh, ds-maxheaplow – Specify soft and hard thresholds for heap memory use

Description

PROPERTY	VALUE
Entry DN	cn=config,cn=ldbm database,cn=plugins,cn=config
Valid Range	Range depends on the deployment. The value is checked against the run-time values.
Default Value	Not set by default.
Syntax	Integer

These attributes specify threshold values for dynamic memory footprint. When the memory threshold is reached, Directory Server attempts to free memory from the entry caches, and limit memory use.

• When ds-maxheaplow is reached, Directory Server attempts to free memory concurrently with other operations.

• When ds-maxheaphigh is reached, Directory Server prevents operations on the cache while memory is freed.

These attributes safeguard against sudden increases of memory footprint due to changes in allocation patterns. As such, the memory thresholds should be higher than the sum of all entry caches, plus the memory footprint at startup.

ds-maxheaphigh and ds-maxheaplow must be configured in conjunction with each other, as follows.

• If ds-maxheaphigh is zero or is not set, ds-maxheaplow is ignored.

• If ds-maxheaphigh is set, its value must be at least one gigabyte.

• If ds-maxheaphigh is set, the value of ds-maxheaplow must be less than that of ds-maxheaphigh.

• If ds-maxheaphigh is set to a value other than zero, ds-maxheaplow is automatically set by default to 7/8 of the value of ds-maxheaphigh.

• If ds-maxheaphigh and ds-maxheaplow are both set to a value other than zero, ds-maxheaplow must be greater than or equal to (ds-maxheaphigh + minheap)/2, where minheap is the twice of the memory required during startup. If this condition is not met, ds-maxheaplow is automatically set by default to 7/8 of the value of ds-maxheaphigh.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

heapmaxhighhits(5dsconf)

ODSEE 11.1.1.3.0  Last Revised June 2010

Name | Description | Attributes | See Also

ds-maxheaplow(5dsconf)

Name | Description | Attributes | See Also

Name

ds-maxheaphigh, ds-maxheaplow – Specify soft and hard thresholds for heap memory use

Description

PROPERTY	VALUE
Entry DN	cn=config,cn=ldbm database,cn=plugins,cn=config
Valid Range	Range depends on the deployment. The value is checked against the run-time values.
Default Value	Not set by default.
Syntax	Integer

These attributes specify threshold values for dynamic memory footprint. When the memory threshold is reached, Directory Server attempts to free memory from the entry caches, and limit memory use.

• When ds-maxheaplow is reached, Directory Server attempts to free memory concurrently with other operations.

• When ds-maxheaphigh is reached, Directory Server prevents operations on the cache while memory is freed.

These attributes safeguard against sudden increases of memory footprint due to changes in allocation patterns. As such, the memory thresholds should be higher than the sum of all entry caches, plus the memory footprint at startup.

ds-maxheaphigh and ds-maxheaplow must be configured in conjunction with each other, as follows.

• If ds-maxheaphigh is zero or is not set, ds-maxheaplow is ignored.

• If ds-maxheaphigh is set, its value must be at least one gigabyte.

• If ds-maxheaphigh is set, the value of ds-maxheaplow must be less than that of ds-maxheaphigh.

• If ds-maxheaphigh is set to a value other than zero, ds-maxheaplow is automatically set by default to 7/8 of the value of ds-maxheaphigh.

• If ds-maxheaphigh and ds-maxheaplow are both set to a value other than zero, ds-maxheaplow must be greater than or equal to (ds-maxheaphigh + minheap)/2, where minheap is the twice of the memory required during startup. If this condition is not met, ds-maxheaplow is automatically set by default to 7/8 of the value of ds-maxheaphigh.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

heapmaxhighhits(5dsconf)

ODSEE 11.1.1.3.0  Last Revised June 2010

Name | Description | Attributes | See Also

dsml-answer-size(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

dsml-buffer-size(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

dsml-client-auth-mode(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

dsml-enabled(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

dsml-max-parser-count(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

dsml-min-parser-count(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

dsml-port(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

dsml-relative-root-url(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

dsml-request-max-size(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

dsml-secure-port(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

dsReplFractionalExclude(5dsconf)

Name | Description | Examples | Attributes | See Also

Name

dsReplFractionalExclude – Attribute types to exclude from replication

Description

PROPERTY	VALUE
Entry DN	cn=agreement name,cn=replica,cn=suffix name,cn=mapping tree,cn=config
Valid Range	Any valid attribute type
Default Value	N/A
Syntax	DirectoryString

This attribute is part of replica configuration for nsDS5ReplicationAgreement entries.

When this multi-valued fractional replication configuration attribute is set, the supplier does not send updates for the specified attribute types when replicating to the consumer. This attribute is mutually exclusive with dsReplFractionalInclude(5dsconf).

Examples

dsReplFractionalExclude: userPassword

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

replication(5dsconf)

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Examples | Attributes | See Also

dsReplFractionalInclude(5dsconf)

Name | Description | Examples | Attributes | See Also

Name

dsReplFractionalInclude – Attribute types to include in replication

Description

PROPERTY	VALUE
Entry DN	cn=agreement name,cn=replica,cn=suffix name,cn=mapping tree,cn=config
Valid Range	Any valid attribute type
Default Value	N/A
Syntax	DirectoryString

This attribute is part of replica configuration for nsDS5ReplicationAgreement entries.

When this multi-valued fractional replication configuration attribute is set, the supplier send updates only for the specified attribute types when replicating to the consumer. This attribute is mutually exclusive with dsReplFractionalExclude(5dsconf).

Examples

dsReplFractionalInclude: cn
dsReplFractionalInclude: mail
dsReplFractionalInclude: objectClass
dsReplFractionalInclude: sn

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

replication(5dsconf)

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Examples | Attributes | See Also

enabled(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

enabled – Whether the configuration element is operational

Description

Syntax	on | off
Default Value	Depends on the configuration element
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

Use this property to turn on the configuration element.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), log(5dsconf), plugin(5dsconf), repl-agmt(5dsconf), suffix(5dsconf)

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | SYNTAX VALUES | Attributes | See Also

encryption(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

encryption, algorithm – DS attribute encryption (ETA) properties

Description

Directory Server allows you to encrypt individual attributes to protect sensitive information stored in the directory. The encryption does not prevent client applications from reading the attributes. Instead it works at the database index file level to prevent users with access to read database index files from being able to search through the indexes for sensitive information.

For example, before attribute encryption is configured for uid attributes, a user with read access to database index files could easily find out that bjensen is a uid attribute value:

$ strings example_uid.db3 | grep bjensen =bjensen $

Once uid attributes are encrypted, the job is not so easy:

$ strings example_uid.db3 | grep bjensen $

Notice however that encrypted RDN values are not fully hidden. Instead they appear in clear in the DN index:

$ strings example_entrydn.db3 | grep bjensen =uid=bjensen,ou=people,dc=example,dc=com =uid=bjensen,ou=people,dc=example,dc=com $

PROPERTY: algorithm

Syntax	des|des3|rc2|rc4
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

Directory Server uses a cipher to encrypt a specified attribute in a given suffix. This property specifies the cipher used.

The following property values are supported:

des

DES block cipher

des3

Triple-DES block cipher

rc2

RC2 block cipher

rc4

RC4 stream cipher

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), desc(5dsconf)

ODSEE 11.1.1.3.0  Last Revised June 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

entry-cache-count(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

suffix, db-name, entry-cache-count, entry-cache-size, entry-count, index-filter-analyzer-enabled, index-filter-analyzer-max-entries, parent-suffix-dn, referral-mode, repl-accept-client-update-enabled, repl-cl-max-age, repl-cl-max-entry-count, repl-id, repl-manager-bind-dn, repl-purge-delay, repl-rewrite-referrals-enabled, repl-role, require-index-enabled – DS suffix configuration (SUF) properties

Description

Each Directory Server suffix you create is configured according to the suffix properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: db-name

Syntax	STRING
Default Value	suffixName
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the suffix that is used to process requests involving the database.

PROPERTY: db-path

Syntax	PATH
Default Value	server-instance-dir/db/suffix-dir
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the absolute path to the suffix database.

PROPERTY: entry-cache-count

Syntax	INTEGER | unlimited
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of entries allowed in the entry cache of the suffix.

PROPERTY: entry-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum amount of memory Directory Server requests for the entry cache of the suffix.

PROPERTY: entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the number of entries stored in the suffix.

PROPERTY: index-filter-analyzer-enabled

Syntax	off and on
Default Value	off
Is readable	Yes
Is modifiable	No
Is multi-valued	No
Restart needed	No

This property specifies whether the index filter analyzer is running.

PROPERTY: index-filter-analyzer-max-entries

Syntax	Integer
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No
Restart needed	No

This property specifies the maximum number of entries that the index filter analyzer may contain.

PROPERTY: parent-suffix-dn

Syntax	DN | undefined
Default Value	DN of the parent entry
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the DN of the parent entry for the suffix. The value of this property must logically be a parent of the suffix.

For instance, if you have a suffix with DN dc=com and a suffix dc=example,dc=com, you can set dc=com as the parent-suffix-dn of dc=example,dc=com, and subtree searches with based DN dc=com then also travers dc=example,dc=com.

PROPERTY: referral-mode

Syntax	disabled | enabled | only-on-write
Default Value	disabled
Is readable	Yes
Is modifiable	Yes, if the suffix is not replicated
Is multi-valued	No

This property specifies how referrals are used when a client makes a request involving the suffix.

disabled

Handle requests locally; do not return referral URLs.

enabled

Return referral URLs to client requests.

only-on-write

Return referral URLs to client requests only for write operations.

PROPERTY: repl-accept-client-update-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the replicated suffix accepts write operations from client applications, or instead returns referral URLs.

PROPERTY: repl-cl-max-age

Syntax	DURATION | undefined
Default Value	7d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age for a record in the replication changelog. Older records are purged.

PROPERTY: repl-cl-max-entry-count

Syntax	INTEGER
Default Value	0 (meaning undefined)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the replication changelog. When the limit is exceeded, older records are purged.

PROPERTY: repl-id

Syntax	INTEGER
Default Value	None
Is readable	Yes
Is modifiable	Yes, using the subcommands to manage replication
Is multi-valued	No

This property specifies the replica identification number, 1-65534 for a supplier, 65535 for a consumer or a hub. Once set, this property cannot be modified.

PROPERTY: repl-manager-bind-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the bind DNs of users allowed to bind to perform replication operations on the suffix.

PROPERTY: repl-purge-delay

Syntax	DURATION | never
Default Value	7d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of tombstone entries used by replication. Tombstone entries are entries marked for deletion that have not yet been removed, and also replication state information associated with the entries. When setting this attribute, ensure that the purge delay is longer than the longest replication cycle in your replication policy to avoid incurring conflict resolution problems and divergence between replicas.

PROPERTY: repl-rewrite-referrals-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referrals you set can be automatically overwritten by the server to reference replicas.

PROPERTY: repl-role

Syntax	not-replicated | master | hub | consumer
Default Value	not-replicated
Is readable	Yes
Is modifiable	Yes, using the subcommands to manage replication
Is multi-valued	No

This property specifies the role played by the suffix in a replicated topology.

not-replicated

The suffix is not part of a replicated toplogy.

master

This suffix is a supplier of replication updates in a replicated topology. It can accept both read and write operations.

hub

This suffix is a supplier of replication updates in a replicated topology. It can accept read operations and replication updates.

consumer

This suffix is a dedicated consumer of replication updates in a replicated topology. It can accept read operations and replication updates, but not writes from clients.

To promote a replica, use the dsconf promote-repl command. To demote a replica, use the dsconf demote-repl command.

PROPERTY: require-index-enabled

Syntax	on|off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether unindexed searches are allowed. When on, unindexed searches return LDAP_UNWILLING_TO_PERFORM.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), enabled(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

entry-cache-size(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

suffix, db-name, entry-cache-count, entry-cache-size, entry-count, index-filter-analyzer-enabled, index-filter-analyzer-max-entries, parent-suffix-dn, referral-mode, repl-accept-client-update-enabled, repl-cl-max-age, repl-cl-max-entry-count, repl-id, repl-manager-bind-dn, repl-purge-delay, repl-rewrite-referrals-enabled, repl-role, require-index-enabled – DS suffix configuration (SUF) properties

Description

Each Directory Server suffix you create is configured according to the suffix properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: db-name

Syntax	STRING
Default Value	suffixName
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the suffix that is used to process requests involving the database.

PROPERTY: db-path

Syntax	PATH
Default Value	server-instance-dir/db/suffix-dir
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the absolute path to the suffix database.

PROPERTY: entry-cache-count

Syntax	INTEGER | unlimited
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of entries allowed in the entry cache of the suffix.

PROPERTY: entry-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum amount of memory Directory Server requests for the entry cache of the suffix.

PROPERTY: entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the number of entries stored in the suffix.

PROPERTY: index-filter-analyzer-enabled

Syntax	off and on
Default Value	off
Is readable	Yes
Is modifiable	No
Is multi-valued	No
Restart needed	No

This property specifies whether the index filter analyzer is running.

PROPERTY: index-filter-analyzer-max-entries

Syntax	Integer
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No
Restart needed	No

This property specifies the maximum number of entries that the index filter analyzer may contain.

PROPERTY: parent-suffix-dn

Syntax	DN | undefined
Default Value	DN of the parent entry
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the DN of the parent entry for the suffix. The value of this property must logically be a parent of the suffix.

For instance, if you have a suffix with DN dc=com and a suffix dc=example,dc=com, you can set dc=com as the parent-suffix-dn of dc=example,dc=com, and subtree searches with based DN dc=com then also travers dc=example,dc=com.

PROPERTY: referral-mode

Syntax	disabled | enabled | only-on-write
Default Value	disabled
Is readable	Yes
Is modifiable	Yes, if the suffix is not replicated
Is multi-valued	No

This property specifies how referrals are used when a client makes a request involving the suffix.

disabled

Handle requests locally; do not return referral URLs.

enabled

Return referral URLs to client requests.

only-on-write

Return referral URLs to client requests only for write operations.

PROPERTY: repl-accept-client-update-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the replicated suffix accepts write operations from client applications, or instead returns referral URLs.

PROPERTY: repl-cl-max-age

Syntax	DURATION | undefined
Default Value	7d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age for a record in the replication changelog. Older records are purged.

PROPERTY: repl-cl-max-entry-count

Syntax	INTEGER
Default Value	0 (meaning undefined)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the replication changelog. When the limit is exceeded, older records are purged.

PROPERTY: repl-id

Syntax	INTEGER
Default Value	None
Is readable	Yes
Is modifiable	Yes, using the subcommands to manage replication
Is multi-valued	No

This property specifies the replica identification number, 1-65534 for a supplier, 65535 for a consumer or a hub. Once set, this property cannot be modified.

PROPERTY: repl-manager-bind-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the bind DNs of users allowed to bind to perform replication operations on the suffix.

PROPERTY: repl-purge-delay

Syntax	DURATION | never
Default Value	7d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of tombstone entries used by replication. Tombstone entries are entries marked for deletion that have not yet been removed, and also replication state information associated with the entries. When setting this attribute, ensure that the purge delay is longer than the longest replication cycle in your replication policy to avoid incurring conflict resolution problems and divergence between replicas.

PROPERTY: repl-rewrite-referrals-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referrals you set can be automatically overwritten by the server to reference replicas.

PROPERTY: repl-role

Syntax	not-replicated | master | hub | consumer
Default Value	not-replicated
Is readable	Yes
Is modifiable	Yes, using the subcommands to manage replication
Is multi-valued	No

This property specifies the role played by the suffix in a replicated topology.

not-replicated

The suffix is not part of a replicated toplogy.

master

This suffix is a supplier of replication updates in a replicated topology. It can accept both read and write operations.

hub

This suffix is a supplier of replication updates in a replicated topology. It can accept read operations and replication updates.

consumer

This suffix is a dedicated consumer of replication updates in a replicated topology. It can accept read operations and replication updates, but not writes from clients.

To promote a replica, use the dsconf promote-repl command. To demote a replica, use the dsconf demote-repl command.

PROPERTY: require-index-enabled

Syntax	on|off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether unindexed searches are allowed. When on, unindexed searches return LDAP_UNWILLING_TO_PERFORM.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), enabled(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

entry-count(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

suffix, db-name, entry-cache-count, entry-cache-size, entry-count, index-filter-analyzer-enabled, index-filter-analyzer-max-entries, parent-suffix-dn, referral-mode, repl-accept-client-update-enabled, repl-cl-max-age, repl-cl-max-entry-count, repl-id, repl-manager-bind-dn, repl-purge-delay, repl-rewrite-referrals-enabled, repl-role, require-index-enabled – DS suffix configuration (SUF) properties

Description

Each Directory Server suffix you create is configured according to the suffix properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: db-name

Syntax	STRING
Default Value	suffixName
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the suffix that is used to process requests involving the database.

PROPERTY: db-path

Syntax	PATH
Default Value	server-instance-dir/db/suffix-dir
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the absolute path to the suffix database.

PROPERTY: entry-cache-count

Syntax	INTEGER | unlimited
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of entries allowed in the entry cache of the suffix.

PROPERTY: entry-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum amount of memory Directory Server requests for the entry cache of the suffix.

PROPERTY: entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the number of entries stored in the suffix.

PROPERTY: index-filter-analyzer-enabled

Syntax	off and on
Default Value	off
Is readable	Yes
Is modifiable	No
Is multi-valued	No
Restart needed	No

This property specifies whether the index filter analyzer is running.

PROPERTY: index-filter-analyzer-max-entries

Syntax	Integer
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No
Restart needed	No

This property specifies the maximum number of entries that the index filter analyzer may contain.

PROPERTY: parent-suffix-dn

Syntax	DN | undefined
Default Value	DN of the parent entry
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the DN of the parent entry for the suffix. The value of this property must logically be a parent of the suffix.

For instance, if you have a suffix with DN dc=com and a suffix dc=example,dc=com, you can set dc=com as the parent-suffix-dn of dc=example,dc=com, and subtree searches with based DN dc=com then also travers dc=example,dc=com.

PROPERTY: referral-mode

Syntax	disabled | enabled | only-on-write
Default Value	disabled
Is readable	Yes
Is modifiable	Yes, if the suffix is not replicated
Is multi-valued	No

This property specifies how referrals are used when a client makes a request involving the suffix.

disabled

Handle requests locally; do not return referral URLs.

enabled

Return referral URLs to client requests.

only-on-write

Return referral URLs to client requests only for write operations.

PROPERTY: repl-accept-client-update-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the replicated suffix accepts write operations from client applications, or instead returns referral URLs.

PROPERTY: repl-cl-max-age

Syntax	DURATION | undefined
Default Value	7d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age for a record in the replication changelog. Older records are purged.

PROPERTY: repl-cl-max-entry-count

Syntax	INTEGER
Default Value	0 (meaning undefined)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the replication changelog. When the limit is exceeded, older records are purged.

PROPERTY: repl-id

Syntax	INTEGER
Default Value	None
Is readable	Yes
Is modifiable	Yes, using the subcommands to manage replication
Is multi-valued	No

This property specifies the replica identification number, 1-65534 for a supplier, 65535 for a consumer or a hub. Once set, this property cannot be modified.

PROPERTY: repl-manager-bind-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the bind DNs of users allowed to bind to perform replication operations on the suffix.

PROPERTY: repl-purge-delay

Syntax	DURATION | never
Default Value	7d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of tombstone entries used by replication. Tombstone entries are entries marked for deletion that have not yet been removed, and also replication state information associated with the entries. When setting this attribute, ensure that the purge delay is longer than the longest replication cycle in your replication policy to avoid incurring conflict resolution problems and divergence between replicas.

PROPERTY: repl-rewrite-referrals-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referrals you set can be automatically overwritten by the server to reference replicas.

PROPERTY: repl-role

Syntax	not-replicated | master | hub | consumer
Default Value	not-replicated
Is readable	Yes
Is modifiable	Yes, using the subcommands to manage replication
Is multi-valued	No

This property specifies the role played by the suffix in a replicated topology.

not-replicated

The suffix is not part of a replicated toplogy.

master

This suffix is a supplier of replication updates in a replicated topology. It can accept both read and write operations.

hub

This suffix is a supplier of replication updates in a replicated topology. It can accept read operations and replication updates.

consumer

This suffix is a dedicated consumer of replication updates in a replicated topology. It can accept read operations and replication updates, but not writes from clients.

To promote a replica, use the dsconf promote-repl command. To demote a replica, use the dsconf demote-repl command.

PROPERTY: require-index-enabled

Syntax	on|off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether unindexed searches are allowed. When on, unindexed searches return LDAP_UNWILLING_TO_PERFORM.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), enabled(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

eq-enabled(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

index, all-ids-threshold-eq, all-ids-threshold-pres, all-ids-threshold-sub, approx-enabled, eq-enabled, matching-rule, pres-enabled, sub-enabled, system – DS attribute indexing (IDX) properties

Description

Directory Server can index attributes, making them faster to search. The dsconf command helps you configure five of the six supported index types:

1. Equality indexes to determine expediently whether an attribute value is equal to a specified value

2. Presence indexes to determine whether a specified attribute has any values

3. Substring indexes to determine whether a specified attribute has values containing a specified string, also used to compare regular expressions to attribute values

4. Approximate indexes, based on metaphone approximation and useful for English language strings only, to determine whether a specified attribute has any values that sound like the specified string

5. International indexes, also called matching rule indexes, to expedite sorting and searching in accordance with the language rules of a particular locale

The dsconf command does not help you configure virtual list view, also known as browsing, indexes.

The dsconf command does help you assign all IDs threshold values to indexes. As the number of entries and attribute values grows in a directory, the number of attribute values to index also grows, as does therefore the size of the indexes. In some deployments a server can end up maintaining index lists so large that the cost of rebuilding an index when attributes are modified or added outweighs the benefit the index provides for searches. All IDs thresholds limit the growth of large indexes by definining the maximum number of entry identifiers Directory Server maintains in an index list. You can define all IDs thresholds for individual indexes and for some types of indexes.

Some indexes are maintained by the server for its own use. These are called system indexes. In general, do not modify or remove systems indexes; such modifications could have severe repercussions on performance.

See Directory Server Indexing in Oracle Fusion Middleware Reference for Oracle Directory Server Enterprise Edition for further details about indexing.

PROPERTY: all-ids-threshold

Syntax	INTEGER | inherited
Default Value	inherited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the maximum number of entry IDs the server maintains in an index list for the specified attribute type. By default its value is inherited from the all-ids-threshold setting for the suffix, whose default value in turn is inherited from the all-ids-threshold setting for the server, which by default is 4000. In addition to inheritance of default settings, this property handles settings as follows:

inherited

The threshold is inherited from the more global setting.

<2000

The threshold value is rounded up to 2000.

>2000

The setting is used as a guaranteed minimum threshold. Because of internal mechanisms, the real value can be slightly more than the specified value.

After you modify this property, reindex the attribute for which you changed the threshold. For example:

$ dsconf set-index-prop dc=example,dc=com uid all-ids-threshold:5000 $ dsconf reindex -t uid dc=example,dc=com ## example: Indexing attribute: uid ## example: Finished indexing. Task completed (slapd exit code: 0). $

PROPERTY: all-ids-threshold-eq

Syntax	INTEGER | inherited
Default Value	inherited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the all IDs threshold for equality indexes of the specified attribute. By default its value is inherited from the all-ids-threshold setting for the attribute type. See all-ids-threshold(5dsconf) for more information.

PROPERTY: all-ids-threshold-pres

Syntax	INTEGER | inherited
Default Value	inherited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the all IDs threshold for presence indexes of the specified attribute. By default its value is inherited from the all-ids-threshold setting for the attribute type. See all-ids-threshold(5dsconf) for more information.

PROPERTY: all-ids-threshold-sub

Syntax	INTEGER | inherited
Default Value	inherited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the all IDs threshold for substring indexes of the specified attribute. By default its value is inherited from the all-ids-threshold setting for the attribute type. See all-ids-threshold(5dsconf) for more information.

PROPERTY: approx-enabled

Syntax	on|off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether approximate indexes are maintained for the specified attribute type. You cannot set an all IDs threshold value for approximate indexes.

PROPERTY: desc

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

Use this optional property to provide a short description of the index configuration.

PROPERTY: eq-enabled

Syntax	on|off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether equality indexes are maintained for the specified attribute type.

PROPERTY: matching-rule

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the matching rule indexes maintained for the specified attribute type.

Values for this property must be valid collation order object identifiers (OIDs). See Directory Server Internationalized Directory in Directory Server Enterprise Edition Reference for the OIDs corresponding to supported locales.

PROPERTY: pres-enabled

Syntax	on|off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether presence indexes are maintained for the specified attribute type.

PROPERTY: sub-enabled

Syntax	on|off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether substring indexes are maintained for the specified attribute type.

PROPERTY: system

Syntax	true|false
Default Value	false
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property identifies whether the specified index is a system index, and therefore should be left alone.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), desc(5dsconf)

ODSEE 11.1.1.3.0  Last Revised June 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

extended-operations(5dsconf)

Name | Description

Name

extended-operations – LDAP extended operations handled by Directory Server

Description

LDAPv3 extended operations allow definition of additional LDAP operations not defined in RFC 2251.

Directory Server handles the LDAP extended operations described here according to their interface stability. See attributes(5) for descriptions of interface stability.

INTERFACE STABILITY: STANDARD

1.3.6.1.4.1.1466.20037

Start TLS extended operation request, described in RFC 2849

1.3.6.1.4.1.4203.1.11.1

Password modify extended operation, described in RFC 3062

1.3.6.1.4.1.4203.1.11.3

Who am I? extended operation, described in RFC 4532

INTERFACE STABILITY: PRIVATE

1.3.6.1.4.1.42.2.27.9.6.1

Replication protocol private extended operation

1.3.6.1.4.1.42.2.27.9.6.2

Replication protocol private extended operation

1.3.6.1.4.1.42.2.27.9.6.3

Replication protocol private extended operation

1.3.6.1.4.1.42.2.27.9.6.4

Replication protocol private extended operation

1.3.6.1.4.1.42.2.27.9.6.5

Replication protocol private extended operation

1.3.6.1.4.1.42.2.27.9.6.6

Replication protocol private extended operation

1.3.6.1.4.1.42.2.27.9.6.7

Replication protocol private extended operation

1.3.6.1.4.1.42.2.27.9.6.8

Replication protocol private extended operation

1.3.6.1.4.1.42.2.27.9.6.9

Replication protocol private extended operation

1.3.6.1.4.1.42.2.27.9.6.11

Replication protocol private extended operation

1.3.6.1.4.1.42.2.27.9.6.12

Replication protocol private extended operation

1.3.6.1.4.1.42.2.27.9.6.13

Replication protocol private extended operation

1.3.6.1.4.1.42.2.27.9.6.14

Replication protocol private extended operation

1.3.6.1.4.1.42.2.27.9.6.15

Replication protocol private extended operation

1.3.6.1.4.1.42.2.27.9.6.16

Replication protocol private extended operation

1.3.6.1.4.1.42.2.27.9.6.17

Replication protocol private extended operation

1.3.6.1.4.1.42.2.27.9.6.18

Replication protocol private extended operation

1.3.6.1.4.1.42.2.27.9.6.19

Replication protocol private extended operation

1.3.6.1.4.1.42.2.27.9.6.21

Replication protocol private extended operation

1.3.6.1.4.1.42.2.27.9.6.22

Replication protocol private extended operation

1.3.6.1.4.1.42.2.27.9.6.23

Replication protocol private extended operation

2.16.840.1.113730.3.5.3

Replication protocol private extended operation

2.16.840.1.113730.3.5.4

Replication protocol private extended operation

2.16.840.1.113730.3.5.5

Replication protocol private extended operation

2.16.840.1.113730.3.5.6

Replication protocol private extended operation

2.16.840.1.113730.3.5.7

Bulk import start extended operation

2.16.840.1.113730.3.5.8

Bulk import finished extended operation

ODSEE 11.1.1.3.0  Last Revised March 1, 2010

Name | Description

feature(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

plugin, argument, depends-on-named, depends-on-type, feature, init-func, lib-path, type, vendor, version – DS plug-in configuration (PLG) properties

Description

Directory Server implements some key functionality as plug-ins. Plug-ins take the form of libraries loaded when the server starts, and called at different points in the processing of client application requests. When you create custom plug-ins, you must configure the server to load and use them, then restart Directory Server to load the newly configured plug-ins.

PROPERTY: argument

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies arguments passed to the plug-in when it is loaded by Directory Server. Arguments are passed in the order you specify them. Updating the list of arguments replaces all the existing arguments previously specified when the plug-in is loaded again.

PROPERTY: depends-on-named

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies names of plug-ins that must be available and loaded before Directory Server loads the current plug-in.

PROPERTY: depends-on-type

Syntax	STRING (See the description that follows.)
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies types of plug-ins that must be available and loaded before Directory Server loads the current plug-in. The value must be the value of a plug-in type property.

PROPERTY: feature

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the plug-in identifier from the Slapi_PluginDesc structure.

PROPERTY: init-func

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of function called by Directory Server to initialize the plug-in.

PROPERTY: lib-path

Syntax	PATH
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the absolute file system path to the library containing plug-in.

PROPERTY: type

Syntax	STRING (See the description that follows.)
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the plug-in type. The following plug-in types are supported.

ldbmentryfetchstore

Entry store and fetch plug-in

extendedop

Extended operation plug-in

passwordcheck

Password check plug-in

postoperation

Post-operation plug-in

preoperation

Pre-operation plug-in

internalpostoperation

Internal post-operation plug-in

internalpreoperation

Internal pre-operation plug-in

matchingrule

Matching rule plug-in for extensible match search filters

object

Generic plug-in type, sometimes used to register other plug-ins

passwordcheck

Strong password check plug-in

pwdstoragescheme

Password storage scheme plug-in

PROPERTY: vendor

Syntax	STRING
Default Value	Vendor name in plug-in configuration
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the plug-in vendor from the Slapi_PluginDesc structure.

PROPERTY: version

Syntax	STRING
Default Value	Version string in plug-in configuration
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the plug-in version from the Slapi_PluginDesc structure.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Stable

See Also

dsconf(1M), desc(5dsconf), enabled(5dsconf)

ODSEE 11.1.1.3.0  Last Revised June 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

file-descriptor-count(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

heap-high-threshold-size(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

heap-low-threshold-size(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

heapmaxhighhits(5dsconf)

Name | Description | Attributes | See Also

Name

heapmaxhighhits, heapmaxlowhits – Counts the number of times ds-maxheaphigh or ds-maxheaplow has been exceeded

Description

PROPERTY	VALUE
Entry DN	cn=monitor
Valid Range	N/A
Default Value	N/A
Syntax	Integer

This read-only attribute counts the number of times that the heapmaxhighhits attribute or the heapmaxlowhits attribute has been exceeded:

• heapmaxhighhits counts the number of times ds-maxheaphigh has been exceeded

• heapmaxlowhits counts the number of times ds-maxheaplow has been exceeded

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Unstable

See Also

ds-maxheaphigh(5dsconf)

ODSEE 11.1.1.3.0  Last Revised June 2010

Name | Description | Attributes | See Also

heapmaxlowhits(5dsconf)

Name | Description | Attributes | See Also

Name

heapmaxhighhits, heapmaxlowhits – Counts the number of times ds-maxheaphigh or ds-maxheaplow has been exceeded

Description

PROPERTY	VALUE
Entry DN	cn=monitor
Valid Range	N/A
Default Value	N/A
Syntax	Integer

This read-only attribute counts the number of times that the heapmaxhighhits attribute or the heapmaxlowhits attribute has been exceeded:

• heapmaxhighhits counts the number of times ds-maxheaphigh has been exceeded

• heapmaxlowhits counts the number of times ds-maxheaplow has been exceeded

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Unstable

See Also

ds-maxheaphigh(5dsconf)

ODSEE 11.1.1.3.0  Last Revised June 2010

Name | Description | Attributes | See Also

host-access-dir-path(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

idle-timeout(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

import-cache-size(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

index(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

index, all-ids-threshold-eq, all-ids-threshold-pres, all-ids-threshold-sub, approx-enabled, eq-enabled, matching-rule, pres-enabled, sub-enabled, system – DS attribute indexing (IDX) properties

Description

Directory Server can index attributes, making them faster to search. The dsconf command helps you configure five of the six supported index types:

1. Equality indexes to determine expediently whether an attribute value is equal to a specified value

2. Presence indexes to determine whether a specified attribute has any values

3. Substring indexes to determine whether a specified attribute has values containing a specified string, also used to compare regular expressions to attribute values

4. Approximate indexes, based on metaphone approximation and useful for English language strings only, to determine whether a specified attribute has any values that sound like the specified string

5. International indexes, also called matching rule indexes, to expedite sorting and searching in accordance with the language rules of a particular locale

The dsconf command does not help you configure virtual list view, also known as browsing, indexes.

The dsconf command does help you assign all IDs threshold values to indexes. As the number of entries and attribute values grows in a directory, the number of attribute values to index also grows, as does therefore the size of the indexes. In some deployments a server can end up maintaining index lists so large that the cost of rebuilding an index when attributes are modified or added outweighs the benefit the index provides for searches. All IDs thresholds limit the growth of large indexes by definining the maximum number of entry identifiers Directory Server maintains in an index list. You can define all IDs thresholds for individual indexes and for some types of indexes.

Some indexes are maintained by the server for its own use. These are called system indexes. In general, do not modify or remove systems indexes; such modifications could have severe repercussions on performance.

See Directory Server Indexing in Oracle Fusion Middleware Reference for Oracle Directory Server Enterprise Edition for further details about indexing.

PROPERTY: all-ids-threshold

Syntax	INTEGER | inherited
Default Value	inherited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the maximum number of entry IDs the server maintains in an index list for the specified attribute type. By default its value is inherited from the all-ids-threshold setting for the suffix, whose default value in turn is inherited from the all-ids-threshold setting for the server, which by default is 4000. In addition to inheritance of default settings, this property handles settings as follows:

inherited

The threshold is inherited from the more global setting.

<2000

The threshold value is rounded up to 2000.

>2000

The setting is used as a guaranteed minimum threshold. Because of internal mechanisms, the real value can be slightly more than the specified value.

After you modify this property, reindex the attribute for which you changed the threshold. For example:

$ dsconf set-index-prop dc=example,dc=com uid all-ids-threshold:5000 $ dsconf reindex -t uid dc=example,dc=com ## example: Indexing attribute: uid ## example: Finished indexing. Task completed (slapd exit code: 0). $

PROPERTY: all-ids-threshold-eq

Syntax	INTEGER | inherited
Default Value	inherited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the all IDs threshold for equality indexes of the specified attribute. By default its value is inherited from the all-ids-threshold setting for the attribute type. See all-ids-threshold(5dsconf) for more information.

PROPERTY: all-ids-threshold-pres

Syntax	INTEGER | inherited
Default Value	inherited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the all IDs threshold for presence indexes of the specified attribute. By default its value is inherited from the all-ids-threshold setting for the attribute type. See all-ids-threshold(5dsconf) for more information.

PROPERTY: all-ids-threshold-sub

Syntax	INTEGER | inherited
Default Value	inherited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the all IDs threshold for substring indexes of the specified attribute. By default its value is inherited from the all-ids-threshold setting for the attribute type. See all-ids-threshold(5dsconf) for more information.

PROPERTY: approx-enabled

Syntax	on|off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether approximate indexes are maintained for the specified attribute type. You cannot set an all IDs threshold value for approximate indexes.

PROPERTY: desc

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

Use this optional property to provide a short description of the index configuration.

PROPERTY: eq-enabled

Syntax	on|off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether equality indexes are maintained for the specified attribute type.

PROPERTY: matching-rule

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the matching rule indexes maintained for the specified attribute type.

Values for this property must be valid collation order object identifiers (OIDs). See Directory Server Internationalized Directory in Directory Server Enterprise Edition Reference for the OIDs corresponding to supported locales.

PROPERTY: pres-enabled

Syntax	on|off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether presence indexes are maintained for the specified attribute type.

PROPERTY: sub-enabled

Syntax	on|off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether substring indexes are maintained for the specified attribute type.

PROPERTY: system

Syntax	true|false
Default Value	false
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property identifies whether the specified index is a system index, and therefore should be left alone.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), desc(5dsconf)

ODSEE 11.1.1.3.0  Last Revised June 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

index-filter-analyzer-enabled(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

suffix, db-name, entry-cache-count, entry-cache-size, entry-count, index-filter-analyzer-enabled, index-filter-analyzer-max-entries, parent-suffix-dn, referral-mode, repl-accept-client-update-enabled, repl-cl-max-age, repl-cl-max-entry-count, repl-id, repl-manager-bind-dn, repl-purge-delay, repl-rewrite-referrals-enabled, repl-role, require-index-enabled – DS suffix configuration (SUF) properties

Description

Each Directory Server suffix you create is configured according to the suffix properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: db-name

Syntax	STRING
Default Value	suffixName
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the suffix that is used to process requests involving the database.

PROPERTY: db-path

Syntax	PATH
Default Value	server-instance-dir/db/suffix-dir
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the absolute path to the suffix database.

PROPERTY: entry-cache-count

Syntax	INTEGER | unlimited
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of entries allowed in the entry cache of the suffix.

PROPERTY: entry-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum amount of memory Directory Server requests for the entry cache of the suffix.

PROPERTY: entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the number of entries stored in the suffix.

PROPERTY: index-filter-analyzer-enabled

Syntax	off and on
Default Value	off
Is readable	Yes
Is modifiable	No
Is multi-valued	No
Restart needed	No

This property specifies whether the index filter analyzer is running.

PROPERTY: index-filter-analyzer-max-entries

Syntax	Integer
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No
Restart needed	No

This property specifies the maximum number of entries that the index filter analyzer may contain.

PROPERTY: parent-suffix-dn

Syntax	DN | undefined
Default Value	DN of the parent entry
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the DN of the parent entry for the suffix. The value of this property must logically be a parent of the suffix.

For instance, if you have a suffix with DN dc=com and a suffix dc=example,dc=com, you can set dc=com as the parent-suffix-dn of dc=example,dc=com, and subtree searches with based DN dc=com then also travers dc=example,dc=com.

PROPERTY: referral-mode

Syntax	disabled | enabled | only-on-write
Default Value	disabled
Is readable	Yes
Is modifiable	Yes, if the suffix is not replicated
Is multi-valued	No

This property specifies how referrals are used when a client makes a request involving the suffix.

disabled

Handle requests locally; do not return referral URLs.

enabled

Return referral URLs to client requests.

only-on-write

Return referral URLs to client requests only for write operations.

PROPERTY: repl-accept-client-update-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the replicated suffix accepts write operations from client applications, or instead returns referral URLs.

PROPERTY: repl-cl-max-age

Syntax	DURATION | undefined
Default Value	7d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age for a record in the replication changelog. Older records are purged.

PROPERTY: repl-cl-max-entry-count

Syntax	INTEGER
Default Value	0 (meaning undefined)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the replication changelog. When the limit is exceeded, older records are purged.

PROPERTY: repl-id

Syntax	INTEGER
Default Value	None
Is readable	Yes
Is modifiable	Yes, using the subcommands to manage replication
Is multi-valued	No

This property specifies the replica identification number, 1-65534 for a supplier, 65535 for a consumer or a hub. Once set, this property cannot be modified.

PROPERTY: repl-manager-bind-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the bind DNs of users allowed to bind to perform replication operations on the suffix.

PROPERTY: repl-purge-delay

Syntax	DURATION | never
Default Value	7d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of tombstone entries used by replication. Tombstone entries are entries marked for deletion that have not yet been removed, and also replication state information associated with the entries. When setting this attribute, ensure that the purge delay is longer than the longest replication cycle in your replication policy to avoid incurring conflict resolution problems and divergence between replicas.

PROPERTY: repl-rewrite-referrals-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referrals you set can be automatically overwritten by the server to reference replicas.

PROPERTY: repl-role

Syntax	not-replicated | master | hub | consumer
Default Value	not-replicated
Is readable	Yes
Is modifiable	Yes, using the subcommands to manage replication
Is multi-valued	No

This property specifies the role played by the suffix in a replicated topology.

not-replicated

The suffix is not part of a replicated toplogy.

master

This suffix is a supplier of replication updates in a replicated topology. It can accept both read and write operations.

hub

This suffix is a supplier of replication updates in a replicated topology. It can accept read operations and replication updates.

consumer

This suffix is a dedicated consumer of replication updates in a replicated topology. It can accept read operations and replication updates, but not writes from clients.

To promote a replica, use the dsconf promote-repl command. To demote a replica, use the dsconf demote-repl command.

PROPERTY: require-index-enabled

Syntax	on|off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether unindexed searches are allowed. When on, unindexed searches return LDAP_UNWILLING_TO_PERFORM.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), enabled(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

index-filter-analyzer-max-entries(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

suffix, db-name, entry-cache-count, entry-cache-size, entry-count, index-filter-analyzer-enabled, index-filter-analyzer-max-entries, parent-suffix-dn, referral-mode, repl-accept-client-update-enabled, repl-cl-max-age, repl-cl-max-entry-count, repl-id, repl-manager-bind-dn, repl-purge-delay, repl-rewrite-referrals-enabled, repl-role, require-index-enabled – DS suffix configuration (SUF) properties

Description

Each Directory Server suffix you create is configured according to the suffix properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: db-name

Syntax	STRING
Default Value	suffixName
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the suffix that is used to process requests involving the database.

PROPERTY: db-path

Syntax	PATH
Default Value	server-instance-dir/db/suffix-dir
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the absolute path to the suffix database.

PROPERTY: entry-cache-count

Syntax	INTEGER | unlimited
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of entries allowed in the entry cache of the suffix.

PROPERTY: entry-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum amount of memory Directory Server requests for the entry cache of the suffix.

PROPERTY: entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the number of entries stored in the suffix.

PROPERTY: index-filter-analyzer-enabled

Syntax	off and on
Default Value	off
Is readable	Yes
Is modifiable	No
Is multi-valued	No
Restart needed	No

This property specifies whether the index filter analyzer is running.

PROPERTY: index-filter-analyzer-max-entries

Syntax	Integer
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No
Restart needed	No

This property specifies the maximum number of entries that the index filter analyzer may contain.

PROPERTY: parent-suffix-dn

Syntax	DN | undefined
Default Value	DN of the parent entry
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the DN of the parent entry for the suffix. The value of this property must logically be a parent of the suffix.

For instance, if you have a suffix with DN dc=com and a suffix dc=example,dc=com, you can set dc=com as the parent-suffix-dn of dc=example,dc=com, and subtree searches with based DN dc=com then also travers dc=example,dc=com.

PROPERTY: referral-mode

Syntax	disabled | enabled | only-on-write
Default Value	disabled
Is readable	Yes
Is modifiable	Yes, if the suffix is not replicated
Is multi-valued	No

This property specifies how referrals are used when a client makes a request involving the suffix.

disabled

Handle requests locally; do not return referral URLs.

enabled

Return referral URLs to client requests.

only-on-write

Return referral URLs to client requests only for write operations.

PROPERTY: repl-accept-client-update-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the replicated suffix accepts write operations from client applications, or instead returns referral URLs.

PROPERTY: repl-cl-max-age

Syntax	DURATION | undefined
Default Value	7d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age for a record in the replication changelog. Older records are purged.

PROPERTY: repl-cl-max-entry-count

Syntax	INTEGER
Default Value	0 (meaning undefined)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the replication changelog. When the limit is exceeded, older records are purged.

PROPERTY: repl-id

Syntax	INTEGER
Default Value	None
Is readable	Yes
Is modifiable	Yes, using the subcommands to manage replication
Is multi-valued	No

This property specifies the replica identification number, 1-65534 for a supplier, 65535 for a consumer or a hub. Once set, this property cannot be modified.

PROPERTY: repl-manager-bind-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the bind DNs of users allowed to bind to perform replication operations on the suffix.

PROPERTY: repl-purge-delay

Syntax	DURATION | never
Default Value	7d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of tombstone entries used by replication. Tombstone entries are entries marked for deletion that have not yet been removed, and also replication state information associated with the entries. When setting this attribute, ensure that the purge delay is longer than the longest replication cycle in your replication policy to avoid incurring conflict resolution problems and divergence between replicas.

PROPERTY: repl-rewrite-referrals-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referrals you set can be automatically overwritten by the server to reference replicas.

PROPERTY: repl-role

Syntax	not-replicated | master | hub | consumer
Default Value	not-replicated
Is readable	Yes
Is modifiable	Yes, using the subcommands to manage replication
Is multi-valued	No

This property specifies the role played by the suffix in a replicated topology.

not-replicated

The suffix is not part of a replicated toplogy.

master

This suffix is a supplier of replication updates in a replicated topology. It can accept both read and write operations.

hub

This suffix is a supplier of replication updates in a replicated topology. It can accept read operations and replication updates.

consumer

This suffix is a dedicated consumer of replication updates in a replicated topology. It can accept read operations and replication updates, but not writes from clients.

To promote a replica, use the dsconf promote-repl command. To demote a replica, use the dsconf demote-repl command.

PROPERTY: require-index-enabled

Syntax	on|off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether unindexed searches are allowed. When on, unindexed searches return LDAP_UNWILLING_TO_PERFORM.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), enabled(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

init-func(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

plugin, argument, depends-on-named, depends-on-type, feature, init-func, lib-path, type, vendor, version – DS plug-in configuration (PLG) properties

Description

Directory Server implements some key functionality as plug-ins. Plug-ins take the form of libraries loaded when the server starts, and called at different points in the processing of client application requests. When you create custom plug-ins, you must configure the server to load and use them, then restart Directory Server to load the newly configured plug-ins.

PROPERTY: argument

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies arguments passed to the plug-in when it is loaded by Directory Server. Arguments are passed in the order you specify them. Updating the list of arguments replaces all the existing arguments previously specified when the plug-in is loaded again.

PROPERTY: depends-on-named

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies names of plug-ins that must be available and loaded before Directory Server loads the current plug-in.

PROPERTY: depends-on-type

Syntax	STRING (See the description that follows.)
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies types of plug-ins that must be available and loaded before Directory Server loads the current plug-in. The value must be the value of a plug-in type property.

PROPERTY: feature

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the plug-in identifier from the Slapi_PluginDesc structure.

PROPERTY: init-func

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of function called by Directory Server to initialize the plug-in.

PROPERTY: lib-path

Syntax	PATH
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the absolute file system path to the library containing plug-in.

PROPERTY: type

Syntax	STRING (See the description that follows.)
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the plug-in type. The following plug-in types are supported.

ldbmentryfetchstore

Entry store and fetch plug-in

extendedop

Extended operation plug-in

passwordcheck

Password check plug-in

postoperation

Post-operation plug-in

preoperation

Pre-operation plug-in

internalpostoperation

Internal post-operation plug-in

internalpreoperation

Internal pre-operation plug-in

matchingrule

Matching rule plug-in for extensible match search filters

object

Generic plug-in type, sometimes used to register other plug-ins

passwordcheck

Strong password check plug-in

pwdstoragescheme

Password storage scheme plug-in

PROPERTY: vendor

Syntax	STRING
Default Value	Vendor name in plug-in configuration
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the plug-in vendor from the Slapi_PluginDesc structure.

PROPERTY: version

Syntax	STRING
Default Value	Version string in plug-in configuration
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the plug-in version from the Slapi_PluginDesc structure.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Stable

See Also

dsconf(1M), desc(5dsconf), enabled(5dsconf)

ODSEE 11.1.1.3.0  Last Revised June 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

instance-path(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

ldap-port(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

ldap-secure-port(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

level(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

log, buffering-enabled, level, max-age, max-disk-space-size, max-file-count, max-size, min-free-disk-space-size, path, perm, rotation-interval, rotation-min-file-size, rotation-time, verbose-enabled – DS logging configuration (LOG) properties

Description

Directory Server writes to three main types of log files you can configure, the INSTANCE_PATH/logs/access, INSTANCE_PATH/logs/audit, and INSTANCE_PATH/logs/errors logs, where INSTANCE_PATH is the full path where the server instance is located, such as /local/dsInst.

When you specify one of these properties with dsconf get-log-prop or dsconf set-log-prop, you must specify which type of log configuration, access, audit, or error, you want to examine. For example, to see whether audit logging is enabled for a server instance:

$ dsconf get-log-prop audit enabled enabled : off $

PROPERTY: buffering-enabled

Syntax	on | off
Default Value	on for access, not applicable to audit and errors logs
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property indicates whether Directory Server writes access log entries directly to disk, or use a buffer, by default.

PROPERTY: enabled

Syntax	on | off
Default Value	on for access, off for audit, on for errors
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property indicates whether the specified log type is enabled.

PROPERTY: level

Syntax	See the description that follows.
Default Value	default
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property defines which kinds of messages get logged. This property is applicable only to access and errors logs.

access log levels

The following settings are supported:

acc-internal

Log access information for internal operations.

default

Log client access to entries.

acc-default_plus_referrals

As default, but also log access to referrals.

acc-timing

Use precise timing for microsecond resolution of elapsed times.

errors log levels

The following settings are supported:

default

Log startup, shutdown, errors, and warnings.

err-function-calls

Log when server enters or exits a function.

err-search-args

Log search arguments.

err-connection

Connection management.

err-packets

Log packets sent and received.

err-search-filter

Log search filter information.

err-config-file

Log information for changes to the configuration file dse.ldif.

err-acl

Log access control processing information.

err-ldbm

Log information from the ldbm database plugin.

err-entry-parsing

Log LDIF parsing errors.

err-housekeeping

Log event queue information.

err-replication

Log information about replication operations.

err-entry-cache

Log entry cache information.

err-plugins

Log information from server plug-ins.

err-dsml

Log information from DSML front end.

err-dsml-advanced

Debugging information for DSML.

PROPERTY: max-age

Syntax	DURATION | unlimited
Default Value	1M (one month)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the age beyond which the specified type of log file is deleted.

PROPERTY: max-disk-space-size

Syntax	MEMORY_SIZE | unlimited
Default Value	500M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the maximum disk space the specified type of log is allowed to consume. When the limit is reached, the server deletes the oldest log file to reclaim disk space.

PROPERTY: max-file-count

Syntax	Integer
Default Value	10 for access, 2 for errors, 1 for audit
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the maximum number of log files, including rotated logs, of the specified type that the server allows to be created in the log file directory. When the limit is reached, the server deletes the oldest log file to reclaim disk space.

When you set this property to 1, the specified log is not rotated.

PROPERTY: max-size

Syntax	MEMORY_SIZE | unlimited
Default Value	100M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the maximum file size for the specified log. When the limit is reached, the server rotates the log file, unless max-file-count is set to 1.

PROPERTY: min-free-disk-space-size

Syntax	MEMORY_SIZE
Default Value	5M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the minimum free space allowed on the disk where the specified log is stored. When the limit is reached, the server deletes the oldest log files until enough space is available.

PROPERTY: path

Syntax	PATH
Default Value	INSTANCE_PATH/logs/access, INSTANCE_PATH/logs/audit, INSTANCE_PATH/logs/errors
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the full path to the specified log file type.

PROPERTY: perm

Syntax	OCTAL_MODE
Default Value	600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the read, write, and execute permissions on the specified log file.

PROPERTY: rotation-interval

Syntax	DURATION | unlimited
Default Value	1d (one day) for access, 1w (one week) for audit and errors
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the duration between rotations of the specified log file.

PROPERTY: rotation-min-file-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the minimum size the specified log file must have before the server rotates it.

PROPERTY: rotation-time

Syntax	TIME | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the time of day when the server rotates the specified log file.

PROPERTY: verbose-enabled

Syntax	on|off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether extra informational messages are written to the errors log.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), enabled(5dsconf)

ODSEE 11.1.1.3.0  Last Revised April 12, 2007

Name | Description | SYNTAX VALUES | Attributes | See Also

lib-path(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

plugin, argument, depends-on-named, depends-on-type, feature, init-func, lib-path, type, vendor, version – DS plug-in configuration (PLG) properties

Description

Directory Server implements some key functionality as plug-ins. Plug-ins take the form of libraries loaded when the server starts, and called at different points in the processing of client application requests. When you create custom plug-ins, you must configure the server to load and use them, then restart Directory Server to load the newly configured plug-ins.

PROPERTY: argument

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies arguments passed to the plug-in when it is loaded by Directory Server. Arguments are passed in the order you specify them. Updating the list of arguments replaces all the existing arguments previously specified when the plug-in is loaded again.

PROPERTY: depends-on-named

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies names of plug-ins that must be available and loaded before Directory Server loads the current plug-in.

PROPERTY: depends-on-type

Syntax	STRING (See the description that follows.)
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies types of plug-ins that must be available and loaded before Directory Server loads the current plug-in. The value must be the value of a plug-in type property.

PROPERTY: feature

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the plug-in identifier from the Slapi_PluginDesc structure.

PROPERTY: init-func

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of function called by Directory Server to initialize the plug-in.

PROPERTY: lib-path

Syntax	PATH
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the absolute file system path to the library containing plug-in.

PROPERTY: type

Syntax	STRING (See the description that follows.)
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the plug-in type. The following plug-in types are supported.

ldbmentryfetchstore

Entry store and fetch plug-in

extendedop

Extended operation plug-in

passwordcheck

Password check plug-in

postoperation

Post-operation plug-in

preoperation

Pre-operation plug-in

internalpostoperation

Internal post-operation plug-in

internalpreoperation

Internal pre-operation plug-in

matchingrule

Matching rule plug-in for extensible match search filters

object

Generic plug-in type, sometimes used to register other plug-ins

passwordcheck

Strong password check plug-in

pwdstoragescheme

Password storage scheme plug-in

PROPERTY: vendor

Syntax	STRING
Default Value	Vendor name in plug-in configuration
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the plug-in vendor from the Slapi_PluginDesc structure.

PROPERTY: version

Syntax	STRING
Default Value	Version string in plug-in configuration
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the plug-in version from the Slapi_PluginDesc structure.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Stable

See Also

dsconf(1M), desc(5dsconf), enabled(5dsconf)

ODSEE 11.1.1.3.0  Last Revised June 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

listen-address(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

log(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

log, buffering-enabled, level, max-age, max-disk-space-size, max-file-count, max-size, min-free-disk-space-size, path, perm, rotation-interval, rotation-min-file-size, rotation-time, verbose-enabled – DS logging configuration (LOG) properties

Description

Directory Server writes to three main types of log files you can configure, the INSTANCE_PATH/logs/access, INSTANCE_PATH/logs/audit, and INSTANCE_PATH/logs/errors logs, where INSTANCE_PATH is the full path where the server instance is located, such as /local/dsInst.

When you specify one of these properties with dsconf get-log-prop or dsconf set-log-prop, you must specify which type of log configuration, access, audit, or error, you want to examine. For example, to see whether audit logging is enabled for a server instance:

$ dsconf get-log-prop audit enabled enabled : off $

PROPERTY: buffering-enabled

Syntax	on | off
Default Value	on for access, not applicable to audit and errors logs
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property indicates whether Directory Server writes access log entries directly to disk, or use a buffer, by default.

PROPERTY: enabled

Syntax	on | off
Default Value	on for access, off for audit, on for errors
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property indicates whether the specified log type is enabled.

PROPERTY: level

Syntax	See the description that follows.
Default Value	default
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property defines which kinds of messages get logged. This property is applicable only to access and errors logs.

access log levels

The following settings are supported:

acc-internal

Log access information for internal operations.

default

Log client access to entries.

acc-default_plus_referrals

As default, but also log access to referrals.

acc-timing

Use precise timing for microsecond resolution of elapsed times.

errors log levels

The following settings are supported:

default

Log startup, shutdown, errors, and warnings.

err-function-calls

Log when server enters or exits a function.

err-search-args

Log search arguments.

err-connection

Connection management.

err-packets

Log packets sent and received.

err-search-filter

Log search filter information.

err-config-file

Log information for changes to the configuration file dse.ldif.

err-acl

Log access control processing information.

err-ldbm

Log information from the ldbm database plugin.

err-entry-parsing

Log LDIF parsing errors.

err-housekeeping

Log event queue information.

err-replication

Log information about replication operations.

err-entry-cache

Log entry cache information.

err-plugins

Log information from server plug-ins.

err-dsml

Log information from DSML front end.

err-dsml-advanced

Debugging information for DSML.

PROPERTY: max-age

Syntax	DURATION | unlimited
Default Value	1M (one month)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the age beyond which the specified type of log file is deleted.

PROPERTY: max-disk-space-size

Syntax	MEMORY_SIZE | unlimited
Default Value	500M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the maximum disk space the specified type of log is allowed to consume. When the limit is reached, the server deletes the oldest log file to reclaim disk space.

PROPERTY: max-file-count

Syntax	Integer
Default Value	10 for access, 2 for errors, 1 for audit
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the maximum number of log files, including rotated logs, of the specified type that the server allows to be created in the log file directory. When the limit is reached, the server deletes the oldest log file to reclaim disk space.

When you set this property to 1, the specified log is not rotated.

PROPERTY: max-size

Syntax	MEMORY_SIZE | unlimited
Default Value	100M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the maximum file size for the specified log. When the limit is reached, the server rotates the log file, unless max-file-count is set to 1.

PROPERTY: min-free-disk-space-size

Syntax	MEMORY_SIZE
Default Value	5M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the minimum free space allowed on the disk where the specified log is stored. When the limit is reached, the server deletes the oldest log files until enough space is available.

PROPERTY: path

Syntax	PATH
Default Value	INSTANCE_PATH/logs/access, INSTANCE_PATH/logs/audit, INSTANCE_PATH/logs/errors
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the full path to the specified log file type.

PROPERTY: perm

Syntax	OCTAL_MODE
Default Value	600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the read, write, and execute permissions on the specified log file.

PROPERTY: rotation-interval

Syntax	DURATION | unlimited
Default Value	1d (one day) for access, 1w (one week) for audit and errors
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the duration between rotations of the specified log file.

PROPERTY: rotation-min-file-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the minimum size the specified log file must have before the server rotates it.

PROPERTY: rotation-time

Syntax	TIME | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the time of day when the server rotates the specified log file.

PROPERTY: verbose-enabled

Syntax	on|off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether extra informational messages are written to the errors log.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), enabled(5dsconf)

ODSEE 11.1.1.3.0  Last Revised April 12, 2007

Name | Description | SYNTAX VALUES | Attributes | See Also

look-through-limit(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

matching-rule(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

index, all-ids-threshold-eq, all-ids-threshold-pres, all-ids-threshold-sub, approx-enabled, eq-enabled, matching-rule, pres-enabled, sub-enabled, system – DS attribute indexing (IDX) properties

Description

Directory Server can index attributes, making them faster to search. The dsconf command helps you configure five of the six supported index types:

1. Equality indexes to determine expediently whether an attribute value is equal to a specified value

2. Presence indexes to determine whether a specified attribute has any values

3. Substring indexes to determine whether a specified attribute has values containing a specified string, also used to compare regular expressions to attribute values

4. Approximate indexes, based on metaphone approximation and useful for English language strings only, to determine whether a specified attribute has any values that sound like the specified string

5. International indexes, also called matching rule indexes, to expedite sorting and searching in accordance with the language rules of a particular locale

The dsconf command does not help you configure virtual list view, also known as browsing, indexes.

The dsconf command does help you assign all IDs threshold values to indexes. As the number of entries and attribute values grows in a directory, the number of attribute values to index also grows, as does therefore the size of the indexes. In some deployments a server can end up maintaining index lists so large that the cost of rebuilding an index when attributes are modified or added outweighs the benefit the index provides for searches. All IDs thresholds limit the growth of large indexes by definining the maximum number of entry identifiers Directory Server maintains in an index list. You can define all IDs thresholds for individual indexes and for some types of indexes.

Some indexes are maintained by the server for its own use. These are called system indexes. In general, do not modify or remove systems indexes; such modifications could have severe repercussions on performance.

See Directory Server Indexing in Oracle Fusion Middleware Reference for Oracle Directory Server Enterprise Edition for further details about indexing.

PROPERTY: all-ids-threshold

Syntax	INTEGER | inherited
Default Value	inherited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the maximum number of entry IDs the server maintains in an index list for the specified attribute type. By default its value is inherited from the all-ids-threshold setting for the suffix, whose default value in turn is inherited from the all-ids-threshold setting for the server, which by default is 4000. In addition to inheritance of default settings, this property handles settings as follows:

inherited

The threshold is inherited from the more global setting.

<2000

The threshold value is rounded up to 2000.

>2000

The setting is used as a guaranteed minimum threshold. Because of internal mechanisms, the real value can be slightly more than the specified value.

After you modify this property, reindex the attribute for which you changed the threshold. For example:

$ dsconf set-index-prop dc=example,dc=com uid all-ids-threshold:5000 $ dsconf reindex -t uid dc=example,dc=com ## example: Indexing attribute: uid ## example: Finished indexing. Task completed (slapd exit code: 0). $

PROPERTY: all-ids-threshold-eq

Syntax	INTEGER | inherited
Default Value	inherited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the all IDs threshold for equality indexes of the specified attribute. By default its value is inherited from the all-ids-threshold setting for the attribute type. See all-ids-threshold(5dsconf) for more information.

PROPERTY: all-ids-threshold-pres

Syntax	INTEGER | inherited
Default Value	inherited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the all IDs threshold for presence indexes of the specified attribute. By default its value is inherited from the all-ids-threshold setting for the attribute type. See all-ids-threshold(5dsconf) for more information.

PROPERTY: all-ids-threshold-sub

Syntax	INTEGER | inherited
Default Value	inherited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the all IDs threshold for substring indexes of the specified attribute. By default its value is inherited from the all-ids-threshold setting for the attribute type. See all-ids-threshold(5dsconf) for more information.

PROPERTY: approx-enabled

Syntax	on|off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether approximate indexes are maintained for the specified attribute type. You cannot set an all IDs threshold value for approximate indexes.

PROPERTY: desc

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

Use this optional property to provide a short description of the index configuration.

PROPERTY: eq-enabled

Syntax	on|off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether equality indexes are maintained for the specified attribute type.

PROPERTY: matching-rule

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the matching rule indexes maintained for the specified attribute type.

Values for this property must be valid collation order object identifiers (OIDs). See Directory Server Internationalized Directory in Directory Server Enterprise Edition Reference for the OIDs corresponding to supported locales.

PROPERTY: pres-enabled

Syntax	on|off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether presence indexes are maintained for the specified attribute type.

PROPERTY: sub-enabled

Syntax	on|off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether substring indexes are maintained for the specified attribute type.

PROPERTY: system

Syntax	true|false
Default Value	false
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property identifies whether the specified index is a system index, and therefore should be left alone.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), desc(5dsconf)

ODSEE 11.1.1.3.0  Last Revised June 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

max-age(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

log, buffering-enabled, level, max-age, max-disk-space-size, max-file-count, max-size, min-free-disk-space-size, path, perm, rotation-interval, rotation-min-file-size, rotation-time, verbose-enabled – DS logging configuration (LOG) properties

Description

Directory Server writes to three main types of log files you can configure, the INSTANCE_PATH/logs/access, INSTANCE_PATH/logs/audit, and INSTANCE_PATH/logs/errors logs, where INSTANCE_PATH is the full path where the server instance is located, such as /local/dsInst.

When you specify one of these properties with dsconf get-log-prop or dsconf set-log-prop, you must specify which type of log configuration, access, audit, or error, you want to examine. For example, to see whether audit logging is enabled for a server instance:

$ dsconf get-log-prop audit enabled enabled : off $

PROPERTY: buffering-enabled

Syntax	on | off
Default Value	on for access, not applicable to audit and errors logs
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property indicates whether Directory Server writes access log entries directly to disk, or use a buffer, by default.

PROPERTY: enabled

Syntax	on | off
Default Value	on for access, off for audit, on for errors
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property indicates whether the specified log type is enabled.

PROPERTY: level

Syntax	See the description that follows.
Default Value	default
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property defines which kinds of messages get logged. This property is applicable only to access and errors logs.

access log levels

The following settings are supported:

acc-internal

Log access information for internal operations.

default

Log client access to entries.

acc-default_plus_referrals

As default, but also log access to referrals.

acc-timing

Use precise timing for microsecond resolution of elapsed times.

errors log levels

The following settings are supported:

default

Log startup, shutdown, errors, and warnings.

err-function-calls

Log when server enters or exits a function.

err-search-args

Log search arguments.

err-connection

Connection management.

err-packets

Log packets sent and received.

err-search-filter

Log search filter information.

err-config-file

Log information for changes to the configuration file dse.ldif.

err-acl

Log access control processing information.

err-ldbm

Log information from the ldbm database plugin.

err-entry-parsing

Log LDIF parsing errors.

err-housekeeping

Log event queue information.

err-replication

Log information about replication operations.

err-entry-cache

Log entry cache information.

err-plugins

Log information from server plug-ins.

err-dsml

Log information from DSML front end.

err-dsml-advanced

Debugging information for DSML.

PROPERTY: max-age

Syntax	DURATION | unlimited
Default Value	1M (one month)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the age beyond which the specified type of log file is deleted.

PROPERTY: max-disk-space-size

Syntax	MEMORY_SIZE | unlimited
Default Value	500M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the maximum disk space the specified type of log is allowed to consume. When the limit is reached, the server deletes the oldest log file to reclaim disk space.

PROPERTY: max-file-count

Syntax	Integer
Default Value	10 for access, 2 for errors, 1 for audit
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the maximum number of log files, including rotated logs, of the specified type that the server allows to be created in the log file directory. When the limit is reached, the server deletes the oldest log file to reclaim disk space.

When you set this property to 1, the specified log is not rotated.

PROPERTY: max-size

Syntax	MEMORY_SIZE | unlimited
Default Value	100M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the maximum file size for the specified log. When the limit is reached, the server rotates the log file, unless max-file-count is set to 1.

PROPERTY: min-free-disk-space-size

Syntax	MEMORY_SIZE
Default Value	5M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the minimum free space allowed on the disk where the specified log is stored. When the limit is reached, the server deletes the oldest log files until enough space is available.

PROPERTY: path

Syntax	PATH
Default Value	INSTANCE_PATH/logs/access, INSTANCE_PATH/logs/audit, INSTANCE_PATH/logs/errors
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the full path to the specified log file type.

PROPERTY: perm

Syntax	OCTAL_MODE
Default Value	600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the read, write, and execute permissions on the specified log file.

PROPERTY: rotation-interval

Syntax	DURATION | unlimited
Default Value	1d (one day) for access, 1w (one week) for audit and errors
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the duration between rotations of the specified log file.

PROPERTY: rotation-min-file-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the minimum size the specified log file must have before the server rotates it.

PROPERTY: rotation-time

Syntax	TIME | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the time of day when the server rotates the specified log file.

PROPERTY: verbose-enabled

Syntax	on|off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether extra informational messages are written to the errors log.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), enabled(5dsconf)

ODSEE 11.1.1.3.0  Last Revised April 12, 2007

Name | Description | SYNTAX VALUES | Attributes | See Also

max-disk-space-size(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

log, buffering-enabled, level, max-age, max-disk-space-size, max-file-count, max-size, min-free-disk-space-size, path, perm, rotation-interval, rotation-min-file-size, rotation-time, verbose-enabled – DS logging configuration (LOG) properties

Description

Directory Server writes to three main types of log files you can configure, the INSTANCE_PATH/logs/access, INSTANCE_PATH/logs/audit, and INSTANCE_PATH/logs/errors logs, where INSTANCE_PATH is the full path where the server instance is located, such as /local/dsInst.

When you specify one of these properties with dsconf get-log-prop or dsconf set-log-prop, you must specify which type of log configuration, access, audit, or error, you want to examine. For example, to see whether audit logging is enabled for a server instance:

$ dsconf get-log-prop audit enabled enabled : off $

PROPERTY: buffering-enabled

Syntax	on | off
Default Value	on for access, not applicable to audit and errors logs
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property indicates whether Directory Server writes access log entries directly to disk, or use a buffer, by default.

PROPERTY: enabled

Syntax	on | off
Default Value	on for access, off for audit, on for errors
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property indicates whether the specified log type is enabled.

PROPERTY: level

Syntax	See the description that follows.
Default Value	default
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property defines which kinds of messages get logged. This property is applicable only to access and errors logs.

access log levels

The following settings are supported:

acc-internal

Log access information for internal operations.

default

Log client access to entries.

acc-default_plus_referrals

As default, but also log access to referrals.

acc-timing

Use precise timing for microsecond resolution of elapsed times.

errors log levels

The following settings are supported:

default

Log startup, shutdown, errors, and warnings.

err-function-calls

Log when server enters or exits a function.

err-search-args

Log search arguments.

err-connection

Connection management.

err-packets

Log packets sent and received.

err-search-filter

Log search filter information.

err-config-file

Log information for changes to the configuration file dse.ldif.

err-acl

Log access control processing information.

err-ldbm

Log information from the ldbm database plugin.

err-entry-parsing

Log LDIF parsing errors.

err-housekeeping

Log event queue information.

err-replication

Log information about replication operations.

err-entry-cache

Log entry cache information.

err-plugins

Log information from server plug-ins.

err-dsml

Log information from DSML front end.

err-dsml-advanced

Debugging information for DSML.

PROPERTY: max-age

Syntax	DURATION | unlimited
Default Value	1M (one month)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the age beyond which the specified type of log file is deleted.

PROPERTY: max-disk-space-size

Syntax	MEMORY_SIZE | unlimited
Default Value	500M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the maximum disk space the specified type of log is allowed to consume. When the limit is reached, the server deletes the oldest log file to reclaim disk space.

PROPERTY: max-file-count

Syntax	Integer
Default Value	10 for access, 2 for errors, 1 for audit
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the maximum number of log files, including rotated logs, of the specified type that the server allows to be created in the log file directory. When the limit is reached, the server deletes the oldest log file to reclaim disk space.

When you set this property to 1, the specified log is not rotated.

PROPERTY: max-size

Syntax	MEMORY_SIZE | unlimited
Default Value	100M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the maximum file size for the specified log. When the limit is reached, the server rotates the log file, unless max-file-count is set to 1.

PROPERTY: min-free-disk-space-size

Syntax	MEMORY_SIZE
Default Value	5M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the minimum free space allowed on the disk where the specified log is stored. When the limit is reached, the server deletes the oldest log files until enough space is available.

PROPERTY: path

Syntax	PATH
Default Value	INSTANCE_PATH/logs/access, INSTANCE_PATH/logs/audit, INSTANCE_PATH/logs/errors
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the full path to the specified log file type.

PROPERTY: perm

Syntax	OCTAL_MODE
Default Value	600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the read, write, and execute permissions on the specified log file.

PROPERTY: rotation-interval

Syntax	DURATION | unlimited
Default Value	1d (one day) for access, 1w (one week) for audit and errors
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the duration between rotations of the specified log file.

PROPERTY: rotation-min-file-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the minimum size the specified log file must have before the server rotates it.

PROPERTY: rotation-time

Syntax	TIME | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the time of day when the server rotates the specified log file.

PROPERTY: verbose-enabled

Syntax	on|off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether extra informational messages are written to the errors log.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), enabled(5dsconf)

ODSEE 11.1.1.3.0  Last Revised April 12, 2007

Name | Description | SYNTAX VALUES | Attributes | See Also

max-file-count(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

log, buffering-enabled, level, max-age, max-disk-space-size, max-file-count, max-size, min-free-disk-space-size, path, perm, rotation-interval, rotation-min-file-size, rotation-time, verbose-enabled – DS logging configuration (LOG) properties

Description

Directory Server writes to three main types of log files you can configure, the INSTANCE_PATH/logs/access, INSTANCE_PATH/logs/audit, and INSTANCE_PATH/logs/errors logs, where INSTANCE_PATH is the full path where the server instance is located, such as /local/dsInst.

When you specify one of these properties with dsconf get-log-prop or dsconf set-log-prop, you must specify which type of log configuration, access, audit, or error, you want to examine. For example, to see whether audit logging is enabled for a server instance:

$ dsconf get-log-prop audit enabled enabled : off $

PROPERTY: buffering-enabled

Syntax	on | off
Default Value	on for access, not applicable to audit and errors logs
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property indicates whether Directory Server writes access log entries directly to disk, or use a buffer, by default.

PROPERTY: enabled

Syntax	on | off
Default Value	on for access, off for audit, on for errors
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property indicates whether the specified log type is enabled.

PROPERTY: level

Syntax	See the description that follows.
Default Value	default
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property defines which kinds of messages get logged. This property is applicable only to access and errors logs.

access log levels

The following settings are supported:

acc-internal

Log access information for internal operations.

default

Log client access to entries.

acc-default_plus_referrals

As default, but also log access to referrals.

acc-timing

Use precise timing for microsecond resolution of elapsed times.

errors log levels

The following settings are supported:

default

Log startup, shutdown, errors, and warnings.

err-function-calls

Log when server enters or exits a function.

err-search-args

Log search arguments.

err-connection

Connection management.

err-packets

Log packets sent and received.

err-search-filter

Log search filter information.

err-config-file

Log information for changes to the configuration file dse.ldif.

err-acl

Log access control processing information.

err-ldbm

Log information from the ldbm database plugin.

err-entry-parsing

Log LDIF parsing errors.

err-housekeeping

Log event queue information.

err-replication

Log information about replication operations.

err-entry-cache

Log entry cache information.

err-plugins

Log information from server plug-ins.

err-dsml

Log information from DSML front end.

err-dsml-advanced

Debugging information for DSML.

PROPERTY: max-age

Syntax	DURATION | unlimited
Default Value	1M (one month)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the age beyond which the specified type of log file is deleted.

PROPERTY: max-disk-space-size

Syntax	MEMORY_SIZE | unlimited
Default Value	500M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the maximum disk space the specified type of log is allowed to consume. When the limit is reached, the server deletes the oldest log file to reclaim disk space.

PROPERTY: max-file-count

Syntax	Integer
Default Value	10 for access, 2 for errors, 1 for audit
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the maximum number of log files, including rotated logs, of the specified type that the server allows to be created in the log file directory. When the limit is reached, the server deletes the oldest log file to reclaim disk space.

When you set this property to 1, the specified log is not rotated.

PROPERTY: max-size

Syntax	MEMORY_SIZE | unlimited
Default Value	100M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the maximum file size for the specified log. When the limit is reached, the server rotates the log file, unless max-file-count is set to 1.

PROPERTY: min-free-disk-space-size

Syntax	MEMORY_SIZE
Default Value	5M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the minimum free space allowed on the disk where the specified log is stored. When the limit is reached, the server deletes the oldest log files until enough space is available.

PROPERTY: path

Syntax	PATH
Default Value	INSTANCE_PATH/logs/access, INSTANCE_PATH/logs/audit, INSTANCE_PATH/logs/errors
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the full path to the specified log file type.

PROPERTY: perm

Syntax	OCTAL_MODE
Default Value	600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the read, write, and execute permissions on the specified log file.

PROPERTY: rotation-interval

Syntax	DURATION | unlimited
Default Value	1d (one day) for access, 1w (one week) for audit and errors
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the duration between rotations of the specified log file.

PROPERTY: rotation-min-file-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the minimum size the specified log file must have before the server rotates it.

PROPERTY: rotation-time

Syntax	TIME | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the time of day when the server rotates the specified log file.

PROPERTY: verbose-enabled

Syntax	on|off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether extra informational messages are written to the errors log.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), enabled(5dsconf)

ODSEE 11.1.1.3.0  Last Revised April 12, 2007

Name | Description | SYNTAX VALUES | Attributes | See Also

max-psearch-count(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

max-size(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

log, buffering-enabled, level, max-age, max-disk-space-size, max-file-count, max-size, min-free-disk-space-size, path, perm, rotation-interval, rotation-min-file-size, rotation-time, verbose-enabled – DS logging configuration (LOG) properties

Description

Directory Server writes to three main types of log files you can configure, the INSTANCE_PATH/logs/access, INSTANCE_PATH/logs/audit, and INSTANCE_PATH/logs/errors logs, where INSTANCE_PATH is the full path where the server instance is located, such as /local/dsInst.

When you specify one of these properties with dsconf get-log-prop or dsconf set-log-prop, you must specify which type of log configuration, access, audit, or error, you want to examine. For example, to see whether audit logging is enabled for a server instance:

$ dsconf get-log-prop audit enabled enabled : off $

PROPERTY: buffering-enabled

Syntax	on | off
Default Value	on for access, not applicable to audit and errors logs
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property indicates whether Directory Server writes access log entries directly to disk, or use a buffer, by default.

PROPERTY: enabled

Syntax	on | off
Default Value	on for access, off for audit, on for errors
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property indicates whether the specified log type is enabled.

PROPERTY: level

Syntax	See the description that follows.
Default Value	default
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property defines which kinds of messages get logged. This property is applicable only to access and errors logs.

access log levels

The following settings are supported:

acc-internal

Log access information for internal operations.

default

Log client access to entries.

acc-default_plus_referrals

As default, but also log access to referrals.

acc-timing

Use precise timing for microsecond resolution of elapsed times.

errors log levels

The following settings are supported:

default

Log startup, shutdown, errors, and warnings.

err-function-calls

Log when server enters or exits a function.

err-search-args

Log search arguments.

err-connection

Connection management.

err-packets

Log packets sent and received.

err-search-filter

Log search filter information.

err-config-file

Log information for changes to the configuration file dse.ldif.

err-acl

Log access control processing information.

err-ldbm

Log information from the ldbm database plugin.

err-entry-parsing

Log LDIF parsing errors.

err-housekeeping

Log event queue information.

err-replication

Log information about replication operations.

err-entry-cache

Log entry cache information.

err-plugins

Log information from server plug-ins.

err-dsml

Log information from DSML front end.

err-dsml-advanced

Debugging information for DSML.

PROPERTY: max-age

Syntax	DURATION | unlimited
Default Value	1M (one month)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the age beyond which the specified type of log file is deleted.

PROPERTY: max-disk-space-size

Syntax	MEMORY_SIZE | unlimited
Default Value	500M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the maximum disk space the specified type of log is allowed to consume. When the limit is reached, the server deletes the oldest log file to reclaim disk space.

PROPERTY: max-file-count

Syntax	Integer
Default Value	10 for access, 2 for errors, 1 for audit
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the maximum number of log files, including rotated logs, of the specified type that the server allows to be created in the log file directory. When the limit is reached, the server deletes the oldest log file to reclaim disk space.

When you set this property to 1, the specified log is not rotated.

PROPERTY: max-size

Syntax	MEMORY_SIZE | unlimited
Default Value	100M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the maximum file size for the specified log. When the limit is reached, the server rotates the log file, unless max-file-count is set to 1.

PROPERTY: min-free-disk-space-size

Syntax	MEMORY_SIZE
Default Value	5M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the minimum free space allowed on the disk where the specified log is stored. When the limit is reached, the server deletes the oldest log files until enough space is available.

PROPERTY: path

Syntax	PATH
Default Value	INSTANCE_PATH/logs/access, INSTANCE_PATH/logs/audit, INSTANCE_PATH/logs/errors
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the full path to the specified log file type.

PROPERTY: perm

Syntax	OCTAL_MODE
Default Value	600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the read, write, and execute permissions on the specified log file.

PROPERTY: rotation-interval

Syntax	DURATION | unlimited
Default Value	1d (one day) for access, 1w (one week) for audit and errors
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the duration between rotations of the specified log file.

PROPERTY: rotation-min-file-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the minimum size the specified log file must have before the server rotates it.

PROPERTY: rotation-time

Syntax	TIME | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the time of day when the server rotates the specified log file.

PROPERTY: verbose-enabled

Syntax	on|off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether extra informational messages are written to the errors log.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), enabled(5dsconf)

ODSEE 11.1.1.3.0  Last Revised April 12, 2007

Name | Description | SYNTAX VALUES | Attributes | See Also

max-thread-count(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

max-thread-per-connection-count(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

min-free-disk-space-size(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

log, buffering-enabled, level, max-age, max-disk-space-size, max-file-count, max-size, min-free-disk-space-size, path, perm, rotation-interval, rotation-min-file-size, rotation-time, verbose-enabled – DS logging configuration (LOG) properties

Description

Directory Server writes to three main types of log files you can configure, the INSTANCE_PATH/logs/access, INSTANCE_PATH/logs/audit, and INSTANCE_PATH/logs/errors logs, where INSTANCE_PATH is the full path where the server instance is located, such as /local/dsInst.

When you specify one of these properties with dsconf get-log-prop or dsconf set-log-prop, you must specify which type of log configuration, access, audit, or error, you want to examine. For example, to see whether audit logging is enabled for a server instance:

$ dsconf get-log-prop audit enabled enabled : off $

PROPERTY: buffering-enabled

Syntax	on | off
Default Value	on for access, not applicable to audit and errors logs
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property indicates whether Directory Server writes access log entries directly to disk, or use a buffer, by default.

PROPERTY: enabled

Syntax	on | off
Default Value	on for access, off for audit, on for errors
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property indicates whether the specified log type is enabled.

PROPERTY: level

Syntax	See the description that follows.
Default Value	default
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property defines which kinds of messages get logged. This property is applicable only to access and errors logs.

access log levels

The following settings are supported:

acc-internal

Log access information for internal operations.

default

Log client access to entries.

acc-default_plus_referrals

As default, but also log access to referrals.

acc-timing

Use precise timing for microsecond resolution of elapsed times.

errors log levels

The following settings are supported:

default

Log startup, shutdown, errors, and warnings.

err-function-calls

Log when server enters or exits a function.

err-search-args

Log search arguments.

err-connection

Connection management.

err-packets

Log packets sent and received.

err-search-filter

Log search filter information.

err-config-file

Log information for changes to the configuration file dse.ldif.

err-acl

Log access control processing information.

err-ldbm

Log information from the ldbm database plugin.

err-entry-parsing

Log LDIF parsing errors.

err-housekeeping

Log event queue information.

err-replication

Log information about replication operations.

err-entry-cache

Log entry cache information.

err-plugins

Log information from server plug-ins.

err-dsml

Log information from DSML front end.

err-dsml-advanced

Debugging information for DSML.

PROPERTY: max-age

Syntax	DURATION | unlimited
Default Value	1M (one month)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the age beyond which the specified type of log file is deleted.

PROPERTY: max-disk-space-size

Syntax	MEMORY_SIZE | unlimited
Default Value	500M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the maximum disk space the specified type of log is allowed to consume. When the limit is reached, the server deletes the oldest log file to reclaim disk space.

PROPERTY: max-file-count

Syntax	Integer
Default Value	10 for access, 2 for errors, 1 for audit
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the maximum number of log files, including rotated logs, of the specified type that the server allows to be created in the log file directory. When the limit is reached, the server deletes the oldest log file to reclaim disk space.

When you set this property to 1, the specified log is not rotated.

PROPERTY: max-size

Syntax	MEMORY_SIZE | unlimited
Default Value	100M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the maximum file size for the specified log. When the limit is reached, the server rotates the log file, unless max-file-count is set to 1.

PROPERTY: min-free-disk-space-size

Syntax	MEMORY_SIZE
Default Value	5M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the minimum free space allowed on the disk where the specified log is stored. When the limit is reached, the server deletes the oldest log files until enough space is available.

PROPERTY: path

Syntax	PATH
Default Value	INSTANCE_PATH/logs/access, INSTANCE_PATH/logs/audit, INSTANCE_PATH/logs/errors
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the full path to the specified log file type.

PROPERTY: perm

Syntax	OCTAL_MODE
Default Value	600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the read, write, and execute permissions on the specified log file.

PROPERTY: rotation-interval

Syntax	DURATION | unlimited
Default Value	1d (one day) for access, 1w (one week) for audit and errors
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the duration between rotations of the specified log file.

PROPERTY: rotation-min-file-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the minimum size the specified log file must have before the server rotates it.

PROPERTY: rotation-time

Syntax	TIME | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the time of day when the server rotates the specified log file.

PROPERTY: verbose-enabled

Syntax	on|off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether extra informational messages are written to the errors log.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), enabled(5dsconf)

ODSEE 11.1.1.3.0  Last Revised April 12, 2007

Name | Description | SYNTAX VALUES | Attributes | See Also

moddn-enabled(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

moddn-enabled – Whether the server accepts mod DN operations

Description

Syntax	on | off
Default Value	off (inherited at suffix level)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts requests to perform modify DN operations (to move entries).

All server instances in a replication topology must be recent enough to have support for modify DN operations before you set this property to on.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), server(5dsconf), suffix(5dsconf)

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | SYNTAX VALUES | Attributes | See Also

mod-tracking-enabled(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

nsAbandonedSearchCheckInterval(5dsconf)

Name | Description | Attributes | See Also

Name

nsAbandonedSearchCheckInterval – interval between checks for abandoned chaining operations

Description

The number of seconds that pass before the server checks for abandoned operations.

Entry DN

cn=default instance config,cn=chaining database, cn=plugins,cn=config

Valid Range

0 to 2147483647 seconds

Default Value

2

Syntax

Integer

Example

nsabandonedsearchcheckinterval: 10

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 6, 2006

Name | Description | Attributes | See Also

nsActiveChainingComponents(5dsconf)

Name | Description | Attributes | See Also

Name

nsActiveChainingComponents – components using chaining

Description

Lists the components using chaining. A component is any functional unit in the server. The value of this attribute overrides the value in the global configuration attribute. To disable chaining on a particular database instance, use the value None.

This attribute also allows you to alter the components used to chain. By default, no components are allowed to chain. For this reason, this attribute does not appear in a list of cn=config,cn=chaining database,cn=config attributes, as LDAP considers empty attributes to be nonexistent.

Entry DN

cn=config,cn=chaining database,cn=plugins,cn=config

Valid Range

Any valid component entry.

Default Value

None

Syntax

DirectoryString

Example

nsActiveChainingComponents: cn=uid uniqueness,cn=plugins,cn=config

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 6, 2006

Name | Description | Attributes | See Also

nsBindConnectionsLimit(5dsconf)

Name | Description | Attributes | See Also

Name

nsBindConnectionsLimit – maximum TCP connections for chaining

Description

Maximum number of TCP connections the chained suffix establishes with the remote server.

Entry DN

cn=default instance config,cn=chaining database, cn=plugins,cn=config

Valid Range

1 to 50 connections

Default Value

3

Syntax

Integer

Example

nsbindconnectionslimit: 3

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 6, 2006

Name | Description | Attributes | See Also

nsBindRetryLimit(5dsconf)

Name | Description | Attributes | See Also

Name

nsBindRetryLimit – maximum bind attemps for chaining suffix

Description

Number of times a chained suffix attempts to bind with the remote server if the initial bind attempt is unsuccessful. A value of 0 here indicates that the chained suffix will only attempt to bind once only.

Entry DN

cn=default instance config,cn=chaining database, cn=plugins,cn=config

Valid Range

0 to 5

Default Value

3

Syntax

Integer

Example

nsbindretrylimit: 3

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 6, 2006

Name | Description | Attributes | See Also

nsBindTimeout(5dsconf)

Name | Description | Attributes | See Also

Name

nsBindTimeout – timeout for chaining binds

Description

Period of time before the bind attempt times out. There is no real Valid Range for this attribute, except reasonable patience limits.

Entry DN

cn=default instance config,cn=chaining database, cn=plugins,cn=config

Valid Range

0 to 60 seconds

Default Value

15

Syntax

Integer

Example

nsbindtimeout:15

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 6, 2006

Name | Description | Attributes | See Also

nsCheckLocalACI(5dsconf)

Name | Description | Attributes | See Also

Name

nsCheckLocalACI – evaluate access control on chained suffix

Description

Reserved for advanced use only. Controls whether ACIs are evaluated on the chained suffix as well as the remote data server. Changes to this attribute only take effect once the server has been restarted.

Entry DN

cn=default instance config,cn=chaining database, cn=plugins,cn=config

Valid Range

on | off

Default Value

off

Syntax

DirectoryString

Example

nschecklocalaci: on

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 6, 2006

Name | Description | Attributes | See Also

nsConcurrentBindLimit(5dsconf)

Name | Description | Attributes | See Also

Name

nsConcurrentBindLimit – maximum concurrent binds on TCP connection for chaining

Description

The maximum number of concurrent bind operations per TCP connection.

Entry DN

cn=default instance config,cn=chaining database, cn=plugins,cn=config

Valid Range

1 to 25 binds

Default Value

10

Syntax

Integer

Example

nsconcurrentbindlimit:10

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 6, 2006

Name | Description | Attributes | See Also

nsConcurrentOperationsLimit(5dsconf)

Name | Description | Attributes | See Also

Name

nsConcurrentOperationsLimit – maximum concurrent operations for chaining

Description

The maximum number of concurrent operations allowed.

Entry DN

cn=default instance config,cn=chaining database, cn=plugins,cn=config

Valid Range

1 to 50 operations

Default Value

50

Syntax

Integer

Example

nsconcurrentoperationslimit: 50

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 6, 2006

Name | Description | Attributes | See Also

nsConnectionLife(5dsconf)

Name | Description | Attributes | See Also

Name

nsConnectionLife – connection lifetime for chaining

Description

Specifies the connection lifetime. You can keep connections between the chained suffix and the remote server open for an unspecified time, or you can close them after a specific period of time. Keeping the connections open is faster, but uses more resources. When the value is 0 and a list of failover servers is provided in the nsFarmServerURL attribute, the “main” server is never contacted after failover to the alternate server.

Entry DN

cn=default instance config,cn=chaining database, cn=plugins,cn=config

Valid Range

0 to limitless seconds (where 0 means forever)

Default Value

0

Syntax

Integer

Example

nsconnectionlife: 0

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 6, 2006

Name | Description | Attributes | See Also

nsds50ruv(5dsconf)

Name | Description | Attributes | See Also

Name

nsds50ruv – Replication update vector, version 5

Description

PROPERTY	VALUE
Entry DN	cn=agreement name,cn=replica,cn=suffix name,cn=mapping tree,cn=config
Valid Range	N/A
Default Value	N/A
Syntax	DirectoryString

This attribute is part of replica configuration for nsDS5ReplicationAgreement entries.

This attribute is responsible for managing the internal state of the replica via the replication update vector. It is always present and must not be changed.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

replication(5dsconf)

ODSEE 11.1.1.3.0  Last Revised March 1, 2010

Name | Description | Attributes | See Also

nsds5BeginReplicaRefresh(5dsconf)

Name | Description | Examples | Attributes | See Also

Name

nsds5BeginReplicaRefresh – Force initialization of the consumer

Description

PROPERTY	VALUE
Entry DN	cn=agreement name,cn=replica,cn=suffix name,cn=mapping tree,cn=config
Valid Range	start | stop
Default Value	N/A
Syntax	DirectoryString

This attribute is part of replica configuration for nsDS5ReplicationAgreement entries.

When set to start, this attribute causes the supplier to perform at total update of the consumer.

Examples

nsds5BeginReplicaRefresh: start

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

replication(5dsconf)

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Examples | Attributes | See Also

nsDS5Flags(5dsconf)

Name | Description | Examples | Attributes | See Also

Name

nsDS5Flags – Change logging and referral flags

Description

PROPERTY	VALUE
Entry DN	cn=replica,cn=suffix name,cn=mapping tree,cn=config
Valid Range	0 | 1 | 4 | 5
Default Value	1 (master), 0 (consumer)
Syntax	Integer

This attribute is part of replica configuration for nsDS5Replica entries.

This attribute takes one of the following values:

0

No changes are logged. Automatic referrals are not overwritten.

1

Changes are logged. Automatic referrals are not overwritten.

4

No changes are logged. Automatic referrals are overwritten.

5

Changes are logged. Automatic referrals are overwritten.

Examples

nsDS5Flags: 1

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

replication(5dsconf)

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Examples | Attributes | See Also

nsDS5Replica(5dsconf)

Name | Description | Extended Description | Attributes | See Also

Name

replication, nsDS5Replica, nsDS5ReplicationAgreement, ReplPriorityRule – Directory Server replication configuration

Description

---

Note –

In most cases you do not need to know how to manage the object classes and attributes mentioned here. Instead you handle replication configuration through Directory Service Control Center or the dsconf(1M) command. The information here is included primarily for those of you who are familiar with command-line configuration for replication in previous Directory Server versions.

---

Replication works in Directory Server using extended operations. Changes to a suffix on a supplier server are replayed on the consumer server. Each server stores configuration information defining its role in replication, and defining the user account that has access to perform replication operations. The supplier server also stores configuration information about the replication agreement it has with the consumer.

Replication configuration is reflected in object classes and attributes under cn=config of the Directory Server instance.

Replica Configuration

The configuration entry that indicates a suffix is replicated has a DN of the following form.

cn=replica,cn=suffix name,cn=mapping tree,cn=config

For example, the following configuration entry DN corresponds to the suffix dc=example,dc=com.

cn=replica,cn=dc\=example\,dc\=com,cn=mapping tree,cn=config

Such entries have the object class nsDS5Replica.

Replication Agreement Configuration

The configuration entries that describe replication agreements with other servers have DNs of the following form.

cn=agreement name,cn=replica,cn=suffix name,cn=mapping tree,
 cn=config

For example, the following configuration entry DN corresponds to the suffix dc=example,dc=com.

cn=ds.example.com:389,cn=replica,cn=dc\=example\,dc\=com,
 cn=mapping tree,cn=config

Replication agreement entries have the object class nsDS5ReplicationAgreement.

Replication Priority Configuration

The configuration entries that describe replication priority rules have DNs of the form:

cn=rule name,cn=replica,cn=suffix name,cn=mapping tree,
 cn=config

For example, the following configuration entry DN corresponds to the suffix dc=example,dc=com.

cn=pwdReplPrio,cn=replica,cn=dc\=example\,dc\=com,cn=mapping tree,
 cn=config

Replication priority rule entries have the object class ReplPriorityRule.

Replication Manager Configuration

The configuration entry for the account used to bind and perform replication has, by default, the DN:

cn=replication manager,cn=replication,cn=config

The account entry is a standard person(5dsoc) object class. It defines the DN and userPassword for replication. The password policy for the account used to bind and perform replication has, by default, the DN:

cn=Password Policy,cn=replication manager,cn=replication,
 cn=config

The password policy entry is governed by the schema for pwpolicy(5dssd). As both person and pwpolicy related object classes and attribute types are described elsewhere, they are not further described here.

Extended Description

This section examines replication configuration on a master supplier server, and on a dedicated consumer server. The sample configurations shown here were created using the dsconf to configure replication.

Supplier Side Configuration

On the supplier side, the key configuration entries are the replica configuration and the replication agreement.

Supplier Replica Configuration

For a master supplier, an nsDS5Replica configuration entry looks something like the following:

dn: cn=replica,cn=\dc=example\,dc\=com,cn=mapping tree,cn=config
nsDS5ReplicaRoot: dc=example,dc=com
nsDS5ReplicaBindDN: cn=replication manager,cn=replication,cn=config
objectClass: top
objectClass: nsDS5Replica
nsDS5ReplicaId: 1
nsDS5Flags: 1
nsDS5ReplicaType: 3
cn: replica
creatorsName: cn=directory manager
modifiersName: cn=directory manager
nsState:: AAEAAAAAAAAAAAAAQ4rs0AAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAA==
nsDS5ReplicaName: d2e14d02-600311da-80ace5db-c83e55ac
numSubordinates: 1

In this example, the key attributes are the following:

nsDS5ReplicaRoot

Holds the DN of the root of the replicated suffix. Once set, it must not be modified.

nsDS5ReplicaBindDN

Holds the DN of the account used to bind for replication. If replication is performed over SSL, this attribute can hold the certificate identity associated with the DN.

nsDS5ReplicaId

Specifies the unique ID of this master supplier server, a value from 1-65534, inclusive.

A hub uses the same replica ID as a consumer, 65535.

nsDS5Flags

Governs change logging and automatic referrals. It takes one of the following values:

0

No changes are logged. Automatic referrals are not overwritten.

1

Changes are logged. Automatic referrals are not overwritten.

4

No changes are logged. Automatic referrals are overwritten.

5

Changes are logged. Automatic referrals are overwritten.

nsDS5ReplicaType

Defines the role this replica plays in replicating with other servers. It takes one of the following values:

0

Reserved for internal use

1

Dedicated supplier

2

Dedicated consumer (read-only)

3

Supplier/consumer (read-write)

cn

This attribute names the replica. Once set, it must not be modified.

nsState

Stores the state of the clock for handling synchronization. Reserved for internal use.

nsDS5ReplicaName

Read-only unique identifier for the replica.

The replica configuration entry can also hold the following attributes not shown here:

ds5BeginReplicaAcceptUpdates(5dsconf)

ds5ReplicaConsumerTimeout(5dsconf)

ds5LastInitTimeStamp(5dsconf)

ds5ReferralDelayAfterInit(5dsconf)

dsChangelogMaxAge(5dsconf)

dsChangelogMaxentries(5dsconf)

dsFilterSPConfigchecksum(5dsconf)

nsDS5ReplicaAutoReferral(5dsconf)

nsDS5ReplicaChangeCount(5dsconf)

nsDS5ReplicaPurgeDelay(5dsconf)

nsDS5ReplicaReferral(5dsconf)

nsDS5ReplicaTombstonePurgeInterval(5dsconf)

nsDS5Task(5dsconf)

Supplier Replication Agreement

For a master supplier, an nsDS5ReplicationAgreement configuration entry looks something like the following:

dn: cn=ds.example.com:389,cn=replica,cn=dc\=example\,dc\=com,
 cn=mapping tree,cn=config
nsDS5ReplicaHost: ds.example.com
nsDS5ReplicaUpdateSchedule: *
nsDS5ReplicaTransportInfo: LDAP
objectClass: top
objectClass: nsDS5ReplicationAgreement
nsDS5ReplicaPort: 389
nsDS5ReplicaBindMethod: SIMPLE
cn: ds.example.com:389
nsDS5ReplicaRoot: dc=example,dc=com
nsDS5ReplicaBindDN: cn=replication manager,cn=replication,
 cn=config
nsDS5ReplicaCredentials:: e0RFU31JakduS3VZSWhEcThEcExDQlU2
 VlN2QTdjcUw4emhDdXl3Sldmc3NTZ2t3eS9mWmR4VmpUZlVYRE1NLzR2T
 UVBDQpyZVdYU3A3U1ZwYz0=

In this example, the key attributes are the following:

nsDS5ReplicaHost

Holds the host name where the consumer runs.

nsDS5ReplicaUpdateSchedule

Specifies when replication happens. If you must restrict the time when replication can happen, set this attribute. This attribute can take multiple values of the form hhmm-hhmm 0123456, where the first element specifies the time span, and the second specifies which days, starting with Sunday (0) to Saturday (6).

nsDS5ReplicaTransportInfo

Specifies the transport used for replication, LDAP or SSL.

nsDS5ReplicaPort

Holds port number on which the consumer listens.

cn

This attribute names the replication agreement. Once set, it must not be modified.

nsDS5ReplicaBindMethod

Specifies bind protocol, SIMPLE, SSLCLIENTAUTH.

nsDS5ReplicaRoot

Holds the DN of the root of the replicated suffix. Once set, it must not be modified.

nsDS5ReplicaBindDN

Holds the DN of the account on the consumer used for replication.

nsDS5ReplicaCredentials

Holds the bind credentials of the account on the consumer used for replication.

The replication agreement entry can also hold the following attributes not shown here:

description(5dsat)

ds5AgreementEnable(5dsconf)

ds5ReplicaAutomaticInit(5dsconf)

ds5ReplicaTransportCompressionLevel(5dsconf)

ds5ReplicaTransportConcurrencyLevel(5dsconf)

ds5ReplicaTransportGroupSize(5dsconf)

ds5ReplicaTransportGrpPktSize(5dsconf)

ds5ReplicaTransportWindowSize(5dsconf)

ds6ruv(5dsconf)

dsReplFractionalExclude(5dsconf)

dsReplFractionalInclude(5dsconf)

nsDS5ReplicaUpdateSchedule(5dsconf)

nsds50ruv(5dsconf)

nsds5BeginReplicaRefresh(5dsconf)

nsds5ReplicaTimeout(5dsconf)

nsds5replicaChangesSentSinceStartup(5dsconf)

nsds5replicaLastInitEnd(5dsconf)

nsds5replicaLastInitStart(5dsconf)

nsds5replicaLastInitStatus(5dsconf)

nsds5replicaLastUpdateEnd(5dsconf)

nsds5replicaLastUpdateStart(5dsconf)

nsds5replicaLastUpdateStatus(5dsconf)

nsds5replicaUpdateInProgress(5dsconf)

Supplier Priority Rule

For a master supplier, a ReplPriorityRule configuration entry looks something like the following:

dn: cn=pwdReplPrio,cn=replica,cn=dc\=example\,dc\=com,cn=mapping tree,cn=config
objectClass: top
objectClass: ReplPriorityRule
replPriorityType: mod
replPriorityAttribute: userPassword
nsDS5ReplicaRoot: dc=example,dc=com
cn: pwdReplPrio

In this example, the key attributes are the following:

replPriorityType

Specifies the type of operation which are replicated with high priority.

replPriorityAttribute

Specifies the attribute whose changes are replicated with high priority.

nsDS5ReplicaRoot

Holds the DN of the root of the replicated suffix to which this priority rule applies.

cn

This attribute names the priority rule.

The replication priority rule entry can also hold the following attributes not shown here:

replPriorityBaseDN(5dsconf)

replPriorityBindDN(5dsconf)

Consumer Side Configuration

On the consumer side, the key configuration entry is the replica configuration. On a dedicated consumer, it is also useful to see how the mapping tree entry for the suffix is configured to refer updates to the supplier.

Consumer Replica Configuration

For a dedicated consumer, an nsDS5Replica configuration entry looks something like the following:

dn: cn=replica,cn=dc\=example\,dc\=com,cn=mapping tree,cn=config
nsDS5ReplicaRoot: dc=example,dc=com
nsDS5ReplicaBindDN: cn=replication manager,cn=replication,cn=config
objectClass: top
objectClass: nsDS5Replica
nsDS5Flags: 0
nsDS5ReplicaType: 2
cn: replica
nsDS5ReplicaId: 65535
nsState:: //8AAAAAAAAAAAAAQ4rtPAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAA==
nsDS5ReplicaName: 07ed9f82-600411da-8096d729-0ba76005
dsFilterSPConfigchecksum: 0
ds5LastInitTimeStamp: 0

Key attributes in this example are explained in Supplier Replica Configuration.

A hub uses the same replica ID as a consumer, 65535.

Referrals On Consumer

For a dedicated consumer suffix, the mapping tree configuration entry refers client applications to the supplier for write operations:

dn: cn=dc\=example\,dc\=com,cn=mapping tree,cn=config
objectClass: top
objectClass: extensibleObject
objectClass: nsMappingTree
nsslapd-backend: example
cn: dc=example,dc=com
numSubordinates: 1
nsslapd-referral: ldap://master.example.com:389/dc%3Dexample,dc%3Dcom
nsslapd-state: referral on update

Notice that the nsslapd-referral attribute refers clients to the master on host master.example.com and port 389 when they request update operations that would write to the directory. These attributes are set by the server when replication is initialized. The dedicated consumer then accepts write operations only from the supplier replica.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dsconf(1M), person(5dsoc), pwpolicy(5dssd)

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Extended Description | Attributes | See Also

nsDS5ReplicaAutoReferral(5dsconf)

Name | Description | Attributes | See Also

Name

nsDS5ReplicaAutoReferral – Reserved for internal use

Description

PROPERTY	VALUE
Entry DN	cn=replica,cn=suffix name,cn=mapping tree,cn=config
Valid Range	N/A
Default Value	None
Syntax	DirectoryString

This attribute is part of replica configuration for nsDS5Replica entries.

This attribute is reserved for internal use.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

replication(5dsconf)

ODSEE 11.1.1.3.0  Last Revised March 1, 2010

Name | Description | Attributes | See Also

nsDS5ReplicaBindDN(5dsconf)

Name | Description | Examples | Attributes | See Also

Name

nsDS5ReplicaBindDN – Bind DN for replication operations

Description

PROPERTY	VALUE
Entry DN	cn=replica,cn=suffix name,cn=mapping tree,cn=config
Valid Range	Any valid account DN
Default Value	cn=replication manager,cn=replication,cn=config
Syntax	DN

This attribute is part of replica configuration for nsDS5Replica, and nsDS5ReplicationAgreement entries.

When this multi-valued attribute is set, the accounts with the specified DNs can be used by the server to bind before performing replication operations. The DNs specified in this attribute can be used in replication agreements on the supplier side, and to bind on the consumer side. The DN can either be a local entry on the consumer server or, in the case of an SSL connection, the certificate identity associated with the same DN.

Examples

nsDS5ReplicaBindDN: cn=replication manager,cn=replication,
 cn=config

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

replication(5dsconf)

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Examples | Attributes | See Also

nsDS5ReplicaBindMethod(5dsconf)

Name | Description | Examples | Attributes | See Also

Name

nsDS5ReplicaBindMethod – Bind protocol used for replication

Description

PROPERTY	VALUE
Entry DN	cn=agreement name,cn=replica,cn=suffix name,cn=mapping tree,cn=config
Valid Range	SIMPLE | SSLCLIENTAUTH
Default Value	SIMPLE
Syntax	DirectoryString

This attribute is part of replica configuration for nsDS5ReplicationAgreement entries.

Specifies the bind protocol used for replication. When this attribute is set to SIMPLE, simple authentication is used. When this attribute is set to SSLLCIENTAUTH, SSL client authentication is used.

Examples

nsDS5ReplicaBindMethod: SIMPLE

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

replication(5dsconf)

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Examples | Attributes | See Also

nsDS5ReplicaChangeCount(5dsconf)

Name | Description | Examples | Attributes | See Also

Name

nsDS5ReplicaChangeCount – Number of entries in the change log

Description

PROPERTY	VALUE
Entry DN	cn=replica,cn=suffix name,cn=mapping tree,cn=config
Valid Range	N/A
Default Value	N/A
Syntax	Integer

This attribute is part of replica configuration for nsDS5Replica entries.

This read-only attribute shows the number of entries remaining in the change log. The change log is purged according to how nsslapd-changelogmaxage and nsslapd-changelogmaxentries are set.

Examples

nsDS5ReplicaChangeCount: 10

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

replication(5dsconf)

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Examples | Attributes | See Also

nsds5replicaChangesSentSinceStartup(5dsconf)

Name | Description | Examples | Attributes | See Also

Name

nsds5replicaChangesSentSinceStartup – Number of updates since startup

Description

PROPERTY	VALUE
Entry DN	cn=agreement name,cn=replica,cn=suffix name,cn=mapping tree,cn=config
Valid Range	0 maximum integer
Default Value	None
Syntax	Integer

This attribute is part of replica configuration for nsDS5ReplicationAgreement entries.

This read-only attribute shows the number of changes sent to this replica since the server started.

Examples

nsds5replicaChangesSentSinceStartup: 161803399

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

replication(5dsconf)

ODSEE 11.1.1.3.0  Last Revised March 1, 2010

Name | Description | Examples | Attributes | See Also

nsDS5ReplicaCredentials(5dsconf)

Name | Description | Examples | Attributes | See Also

Name

nsDS5ReplicaCredentials – Credentials for replication operations

Description

PROPERTY	VALUE
Entry DN	cn=agreement name,cn=replica,cn=suffix name,cn=mapping tree,cn=config
Valid Range	N/A
Default Value	N/A
Syntax	DirectoryString

This attribute is part of replica configuration for nsDS5ReplicationAgreement entries.

Specifies the credentials on the consumer for the account with DN nsDS5ReplicaBindDN(5dsconf) used for replication configured to use simple authentication.

Examples

nsDS5ReplicaCredentials:: e0RFU31JakduS3VZSWhEcThEcExDQlU2
 VlN2QTdjcUw4emhDdXl3Sldmc3NTZ2t3eS9mWmR4VmpUZlVYRE1NLzR2T
 UVBDQpyZVdYU3A3U1ZwYz0=

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

replication(5dsconf)

ODSEE 11.1.1.3.0  Last Revised March 1, 2010

Name | Description | Examples | Attributes | See Also

nsDS5ReplicaHost(5dsconf)

Name | Description | Examples | Attributes | See Also

Name

nsDS5ReplicaHost – Host name of consumer

Description

PROPERTY	VALUE
Entry DN	cn=agreement name,cn=replica,cn=suffix name,cn=mapping tree,cn=config
Valid Range	Any valid host name
Default Value	N/A
Syntax	DirectoryString

This attribute is part of replica configuration for nsDS5ReplicationAgreement entries.

Specifies the hostname for the host where the consumer replica is located. Do not modify this attribute after it has been set.

Examples

nsDS5ReplicaHost: ds.example.com

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

replication(5dsconf)

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Examples | Attributes | See Also

nsDS5ReplicaId(5dsconf)

Name | Description | Examples | Attributes | See Also

Name

nsDS5ReplicaId – Replica identification number

Description

PROPERTY	VALUE
Entry DN	cn=replica,cn=suffix name,cn=mapping tree,cn=config
Valid Range	1-65534 (master), 65535 (consumer or hub)
Default Value	None
Syntax	Integer

This attribute is part of replica configuration for nsDS5Replica entries.

This attribute specifies a unique ID for a master replica in a particular topology, or the ID 65535 for a consumer, or for a hub.

Examples

nsDS5ReplicaId: 1

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

replication(5dsconf)

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Examples | Attributes | See Also

nsds5replicaLastInitEnd(5dsconf)

Name | Description | Examples | Attributes | See Also

Name

nsds5replicaLastInitEnd – Time of last initialization

Description

PROPERTY	VALUE
Entry DN	cn=agreement name,cn=replica,cn=suffix name,cn=mapping tree,cn=config
Valid Range	A valid timestamp
Default Value	None
Syntax	GeneralizedTime

This attribute is part of replica configuration for nsDS5ReplicationAgreement entries.

This read-only attribute shows when the most recent initialization of the replica finished.

Examples

nsds5replicaLastInitEnd: 20051223113229

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

replication(5dsconf)

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Examples | Attributes | See Also

nsds5replicaLastInitStart(5dsconf)

Name | Description | Examples | Attributes | See Also

Name

nsds5replicaLastInitStart – Time of last initialization

Description

PROPERTY	VALUE
Entry DN	cn=agreement name,cn=replica,cn=suffix name,cn=mapping tree,cn=config
Valid Range	A valid timestamp
Default Value	None
Syntax	GeneralizedTime

This attribute is part of replica configuration for nsDS5ReplicationAgreement entries.

This read-only attribute shows when the most recent initialization of the replica started.

Examples

nsds5replicaLastInitStart: 20051223113214

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

replication(5dsconf)

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Examples | Attributes | See Also

nsds5replicaLastInitStatus(5dsconf)

Name | Description | Examples | Attributes | See Also

Name

nsds5replicaLastInitStatus – Replica initialization status

Description

PROPERTY	VALUE
Entry DN	cn=agreement name,cn=replica,cn=suffix name,cn=mapping tree,cn=config
Valid Range	A message concerning initialization
Default Value	None
Syntax	DirectoryString

This attribute is part of replica configuration for nsDS5ReplicationAgreement entries.

This read-only attribute shows the status of the most recent replication initialization.

Examples

nsds5replicaLastInitStatus: 0 Consumer Initialization Succeeded

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

replication(5dsconf)

ODSEE 11.1.1.3.0  Last Revised March 1, 2010

Name | Description | Examples | Attributes | See Also

nsds5replicaLastUpdateEnd(5dsconf)

Name | Description | Examples | Attributes | See Also

Name

nsds5replicaLastUpdateEnd – Time of last update

Description

PROPERTY	VALUE
Entry DN	cn=agreement name,cn=replica,cn=suffix name,cn=mapping tree,cn=config
Valid Range	A valid timestamp
Default Value	None
Syntax	GeneralizedTime

This attribute is part of replica configuration for nsDS5ReplicationAgreement entries.

This read-only attribute shows when the most recent update of the replica finished.

Examples

nsds5replicaLastUpdateEnd: 20051223113229

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

replication(5dsconf)

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Examples | Attributes | See Also

nsds5replicaLastUpdateStart(5dsconf)

Name | Description | Examples | Attributes | See Also

Name

nsds5replicaLastUpdateStart – Time of last update

Description

PROPERTY	VALUE
Entry DN	cn=agreement name,cn=replica,cn=suffix name,cn=mapping tree,cn=config
Valid Range	A valid timestamp
Default Value	None
Syntax	GeneralizedTime

This attribute is part of replica configuration for nsDS5ReplicationAgreement entries.

This read-only attribute shows when the most recent update of the replica started.

Examples

nsds5replicaLastUpdateStart: 20051223113214

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

replication(5dsconf)

ODSEE 11.1.1.3.0  Last Revised March 1, 2010

Name | Description | Examples | Attributes | See Also

nsds5replicaLastUpdateStatus(5dsconf)

Name | Description | Examples | Attributes | See Also

Name

nsds5replicaLastUpdateStatus – Replica update status

Description

PROPERTY	VALUE
Entry DN	cn=agreement name,cn=replica,cn=suffix name,cn=mapping tree,cn=config
Valid Range	A message concerning the last update
Default Value	None
Syntax	DirectoryString

This attribute is part of replica configuration for nsDS5ReplicationAgreement entries.

This read-only attribute shows the status of the latest update of the replica.

Messages include the following.




-1 Could not bind to replica

Solution:

The credentials are wrong for the replication manager bind DN. Fix the replication agreement.




-1 Incremental update has failed and requires a total update

Solution:

Reinitialize the replica. See the errors log to determine what led to the problem.




-1 Incremental update has failed and requires administrator action

Solution:

Reinitialize the replica. See the errors log to determine what led to the problem.




-1 Internal error: Could not get access to the replica RUV

Solution:

Replication stopped and requires a total update. Reinitialize the replica.




-1 Partial replication configuration error

Solution:

Replication stopped and requires configuration fix. Fix the configuration.




-1 Partial replication configuration has changed

Solution:

Replication stopped and requires a total update. Reinitialize the replica.




-1 Total update required

Solution:

Reinitialize the replica. See the errors log to determine what led to the problem.




0 Incremental update session interrupted

Solution:

A directory administrator has stopped or disabled replication.




0 Incremental update session started

Solution:

Replication is proceeding normally.




0 Incremental update session stopped: nothing to replicate

Solution:

Replication is proceeding normally.




0 Incremental update session succeeded

Solution:

Replication is proceeding normally.




0 Incremental update started

Solution:

Replication is proceeding normally




0 Incremental update stopped : Nothing acquired

Solution:

Replication is proceeding normally. Another supplier is replicating to the consumer, and replication from this supplier will resume after that operation finishes.




0 Incremental update succeeded

Solution:

Replication is proceeding normally.




0 No replication sessions started since server startup

Solution:

No replication operation has been attempted yet and therefore no status is available. This is typically the case when restarting replication.




0 Replica acquired successfully

Solution:

Replication is proceeding normally.




0 Replication session successful

Solution:

Replication is proceeding normally.




1 Replication error acquiring replica: replica busy

Solution:

Another supplier is replicating to the consumer, and replication from this supplier will resume after that operation finishes.




11 Replication error acquiring replica: duplicate replica ID detected

Solution:

More than one master is using the same replica ID. Fix the configuration.




12 Replication session aborted

Solution:

The consumer is disabled. Error 8194 should also appear in the errors log. Investigate the cause of the problem, fix it, and restart replication.




2 Replication error acquiring replica: excessive clock skew.

Solution:

The time difference for clocks on different replicas is too big for replication to handle. Synchronize the system clocks.




202 Incremental update session aborted: Timeout while waiting for change acknowledgement [hostname:port-number]

Solution:

Replication is proceeding normally. A timeout temporarily prevented replication from continuing.




3 Replication error acquiring replica: permission denied

Solution:

The credentials are wrong for the replication manager bind DN. Fix the replication agreement.




4 Replication error acquiring replica: decoding error

Solution:

A protocol error occurred.




401 Incremental update session stopped: Could not parse update vector

Solution:

Replication is proceeding normally. A parse error temporarily prevented replication from continuing.




401 Replication session failed, consumer replica needs to be initialized

Solution:

The database on the consumer has not been initialized. Either perform a total update on the consumer, or initialize the consumer with the same data as the supplier.




402 Replication session failed, consumer replica has a different data version

Solution:

The database on the consumer has been initialized with different data from that of the supplier. Either perform a total update on the consumer, or initialize the consumer with the same data as the supplier.




5 Replication error acquiring replica: unknown update protocol

Solution:

The consumer does not support the same replication protocol as the supplier.




6 Replication error acquiring replica: no such replica

Solution:

The consumer is not configured for replication for the suffix to be replicated.




7 Replication error acquiring replica: csn below purge point

Solution:

The replication change log has been purged and therefore no longer contains the changes necessary to update the consumer.




8 Replication error acquiring replica: internal error

Solution:

The consumer failed to replay an replication operation. See the errors log on the consumer to determine what led to the problem.




801 Incremental update session aborted : Unable to adjust the time between replicas

Solution:

The time difference for clocks on different replicas is too big for replication to handle. Synchronize the system clocks, perhaps using the network time protocol (NTP).




810 Replication error acquiring replica: Supplier and consumer use the same replica ID

Solution:

More than one replica is using the same replica ID. Fix the configuration.




820 Incremental update session stopped: unable to replicate schema

Solution:

Replication is proceeding normally, but schema could not be replicated. If this message is observed repeatedly, replicate schema to the consumer manually.




829 Replication error acquiring replica: not able to use partial replication to read-write replica

Solution:

Only consumers can be partial replica. Fix the configuration.




9 Replication error acquiring replica: replica released

Solution:

Replication is proceeding normally.

Examples

nsds5replicaLastUpdateStatus: 0 replica acquired successfully

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduledfor removal after this release

See Also

replication(5dsconf)

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Examples | Attributes | See Also

nsDS5ReplicaName(5dsconf)

Name | Description | Examples | Attributes | See Also

Name

nsDS5ReplicaName – Unique replica identifier

Description

PROPERTY	VALUE
Entry DN	cn=replica,cn=suffix name,cn=mapping tree,cn=config
Valid Range	N/A
Default Value	N/A
Syntax	DirectoryString

This attribute is part of replica configuration for nsDS5Replica entries.

This attribute value is allocated by the server when the replica is created. Reserved for internal use.

Examples

nsDS5ReplicaName: d2e14d02-600311da-80ace5db-c83e55ac

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

replication(5dsconf)

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Examples | Attributes | See Also

nsDS5ReplicaPort(5dsconf)

Name | Description | Examples | Attributes | See Also

Name

nsDS5ReplicaPort – Port number on which consumer listens

Description

PROPERTY	VALUE
Entry DN	cn=agreement name,cn=replica,cn=suffix name,cn=mapping tree,cn=config
Valid Range	Any valid port number
Default Value	N/A
Syntax	Integer

This attribute is part of replica configuration for nsDS5ReplicationAgreement entries.

Specifies the hostname for the port number on which the consumer replica listens. Do not modify this attribute after it has been set.

Examples

nsDS5ReplicaPort: 389

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

replication(5dsconf)

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Examples | Attributes | See Also

nsDS5ReplicaPurgeDelay(5dsconf)

Name | Description | Examples | Attributes | See Also

Name

nsDS5ReplicaPurgeDelay – Maximum time to keep tombstones

Description

PROPERTY	VALUE
Entry DN	cn=replica,cn=suffix name,cn=mapping tree,cn=config
Valid Range	0 (keep forever) to max. integer seconds
Default Value	604800 (one week)
Syntax	Integer

This attribute is part of replica configuration for nsDS5Replica entries.

When this attribute is set, the server deletes tombstone entries older than the number of seconds you specify. Tombstone entries are those entries that have been marked for deletion but not yet removed, and the associated replication state information. When setting this attribute, ensure that the purge delay is longer than the longest replication cycle in your replication policy to avoid incurring conflict resolution problems and divergence between replica.

Examples

nsDS5ReplicaPurgeDelay: 604800

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

replication(5dsconf)

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Examples | Attributes | See Also

nsDS5ReplicaReferral(5dsconf)

Name | Description | Examples | Attributes | See Also

Name

nsDS5ReplicaReferral – Referrals for a replica

Description

PROPERTY	VALUE
Entry DN	cn=replica,cn=suffix name,cn=mapping tree,cn=config
Valid Range	Any valid LDAP URL
Default Value	N/A
Syntax	DirectoryString

This attribute is part of replica configuration for nsDS5Replica entries.

This attribute should be set on a consumer only. When this multi-valued attribute is set, the server returns these referrals when a client attempts to update a read-only consumer.

If this attribute is not set, the read-only consumer refers clients to supplier servers on update.

Examples

nsDS5ReplicaReferral: ldap://master.example.com

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

replication(5dsconf)

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Examples | Attributes | See Also

nsDS5ReplicaRoot(5dsconf)

Name | Description | Examples | Attributes | See Also

Name

nsDS5ReplicaRoot – Base DN for replication

Description

PROPERTY	VALUE
Entry DN	cn=replica,cn=suffix name,cn=mapping tree,cn=config
Valid Range	DN of replicated suffix
Default Value	None
Syntax	DirectoryString

This attribute is part of replica configuration for nsDS5Replica entries.

The server replicates entries below the entry with this DN. This DN must correspond to the root DN of a replicated suffix. Once set, this attribute must not be modified.

Examples

nsDS5ReplicaRoot: dc=example,dc=com

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

replication(5dsconf)

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Examples | Attributes | See Also

nsDS5ReplicatedAttributeList(5dsconf)

Name | Description | Examples | Attributes | See Also

Name

nsDS5ReplicatedAttributeList – Attributes not to replicate

Description

PROPERTY	VALUE
Entry DN	cn=agreement name,cn=replica,cn=suffix name,cn=mapping tree,cn=config
Valid Range	Any valid attribute types
Default Value	N/A
Syntax	DirectoryString

This attribute is part of replica configuration for nsDS5ReplicationAgreement entries.

When this multi-valued attribute is set, the supplier does not replicate updates to the specified attribute types to the consumer.

Examples

nsDS5ReplicatedAttributeList: userPassword

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

replication(5dsconf)

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Examples | Attributes | See Also

nsds5ReplicaTimeout(5dsconf)

Name | Description | Examples | Attributes | See Also

Name

nsds5ReplicaTimeout – Timeout for replication operations

Description

PROPERTY	VALUE
Entry DN	cn=agreement name,cn=replica,cn=suffix name,cn=mapping tree,cn=config
Valid Range	0 maximum integer (seconds)
Default Value	600 (seconds)
Syntax	Integer

This attribute is part of replica configuration for nsDS5ReplicationAgreement entries.

When set, this attribute causes the supplier to wait at most the specified number of seconds for a response from the consumer concerning a replication operation.

If you see Warning: timed out messages in the errors log file, then you should increase the value of this attribute. You can find out the amount of time the operation actually lasted by examining the access log on the consumer. You can then tune this attribute to optimize performance.

Examples

nsds5ReplicaTimeout: 1200

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

replication(5dsconf)

ODSEE 11.1.1.3.0  Last Revised March 1, 2010

Name | Description | Examples | Attributes | See Also

nsDS5ReplicationAgreement(5dsconf)

Name | Description | Extended Description | Attributes | See Also

Name

replication, nsDS5Replica, nsDS5ReplicationAgreement, ReplPriorityRule – Directory Server replication configuration

Description

---

Note –

In most cases you do not need to know how to manage the object classes and attributes mentioned here. Instead you handle replication configuration through Directory Service Control Center or the dsconf(1M) command. The information here is included primarily for those of you who are familiar with command-line configuration for replication in previous Directory Server versions.

---

Replication works in Directory Server using extended operations. Changes to a suffix on a supplier server are replayed on the consumer server. Each server stores configuration information defining its role in replication, and defining the user account that has access to perform replication operations. The supplier server also stores configuration information about the replication agreement it has with the consumer.

Replication configuration is reflected in object classes and attributes under cn=config of the Directory Server instance.

Replica Configuration

The configuration entry that indicates a suffix is replicated has a DN of the following form.

cn=replica,cn=suffix name,cn=mapping tree,cn=config

For example, the following configuration entry DN corresponds to the suffix dc=example,dc=com.

cn=replica,cn=dc\=example\,dc\=com,cn=mapping tree,cn=config

Such entries have the object class nsDS5Replica.

Replication Agreement Configuration

The configuration entries that describe replication agreements with other servers have DNs of the following form.

cn=agreement name,cn=replica,cn=suffix name,cn=mapping tree,
 cn=config

For example, the following configuration entry DN corresponds to the suffix dc=example,dc=com.

cn=ds.example.com:389,cn=replica,cn=dc\=example\,dc\=com,
 cn=mapping tree,cn=config

Replication agreement entries have the object class nsDS5ReplicationAgreement.

Replication Priority Configuration

The configuration entries that describe replication priority rules have DNs of the form:

cn=rule name,cn=replica,cn=suffix name,cn=mapping tree,
 cn=config

For example, the following configuration entry DN corresponds to the suffix dc=example,dc=com.

cn=pwdReplPrio,cn=replica,cn=dc\=example\,dc\=com,cn=mapping tree,
 cn=config

Replication priority rule entries have the object class ReplPriorityRule.

Replication Manager Configuration

The configuration entry for the account used to bind and perform replication has, by default, the DN:

cn=replication manager,cn=replication,cn=config

The account entry is a standard person(5dsoc) object class. It defines the DN and userPassword for replication. The password policy for the account used to bind and perform replication has, by default, the DN:

cn=Password Policy,cn=replication manager,cn=replication,
 cn=config

The password policy entry is governed by the schema for pwpolicy(5dssd). As both person and pwpolicy related object classes and attribute types are described elsewhere, they are not further described here.

Extended Description

This section examines replication configuration on a master supplier server, and on a dedicated consumer server. The sample configurations shown here were created using the dsconf to configure replication.

Supplier Side Configuration

On the supplier side, the key configuration entries are the replica configuration and the replication agreement.

Supplier Replica Configuration

For a master supplier, an nsDS5Replica configuration entry looks something like the following:

dn: cn=replica,cn=\dc=example\,dc\=com,cn=mapping tree,cn=config
nsDS5ReplicaRoot: dc=example,dc=com
nsDS5ReplicaBindDN: cn=replication manager,cn=replication,cn=config
objectClass: top
objectClass: nsDS5Replica
nsDS5ReplicaId: 1
nsDS5Flags: 1
nsDS5ReplicaType: 3
cn: replica
creatorsName: cn=directory manager
modifiersName: cn=directory manager
nsState:: AAEAAAAAAAAAAAAAQ4rs0AAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAA==
nsDS5ReplicaName: d2e14d02-600311da-80ace5db-c83e55ac
numSubordinates: 1

In this example, the key attributes are the following:

nsDS5ReplicaRoot

Holds the DN of the root of the replicated suffix. Once set, it must not be modified.

nsDS5ReplicaBindDN

Holds the DN of the account used to bind for replication. If replication is performed over SSL, this attribute can hold the certificate identity associated with the DN.

nsDS5ReplicaId

Specifies the unique ID of this master supplier server, a value from 1-65534, inclusive.

A hub uses the same replica ID as a consumer, 65535.

nsDS5Flags

Governs change logging and automatic referrals. It takes one of the following values:

0

No changes are logged. Automatic referrals are not overwritten.

1

Changes are logged. Automatic referrals are not overwritten.

4

No changes are logged. Automatic referrals are overwritten.

5

Changes are logged. Automatic referrals are overwritten.

nsDS5ReplicaType

Defines the role this replica plays in replicating with other servers. It takes one of the following values:

0

Reserved for internal use

1

Dedicated supplier

2

Dedicated consumer (read-only)

3

Supplier/consumer (read-write)

cn

This attribute names the replica. Once set, it must not be modified.

nsState

Stores the state of the clock for handling synchronization. Reserved for internal use.

nsDS5ReplicaName

Read-only unique identifier for the replica.

The replica configuration entry can also hold the following attributes not shown here:

ds5BeginReplicaAcceptUpdates(5dsconf)

ds5ReplicaConsumerTimeout(5dsconf)

ds5LastInitTimeStamp(5dsconf)

ds5ReferralDelayAfterInit(5dsconf)

dsChangelogMaxAge(5dsconf)

dsChangelogMaxentries(5dsconf)

dsFilterSPConfigchecksum(5dsconf)

nsDS5ReplicaAutoReferral(5dsconf)

nsDS5ReplicaChangeCount(5dsconf)

nsDS5ReplicaPurgeDelay(5dsconf)

nsDS5ReplicaReferral(5dsconf)

nsDS5ReplicaTombstonePurgeInterval(5dsconf)

nsDS5Task(5dsconf)

Supplier Replication Agreement

For a master supplier, an nsDS5ReplicationAgreement configuration entry looks something like the following:

dn: cn=ds.example.com:389,cn=replica,cn=dc\=example\,dc\=com,
 cn=mapping tree,cn=config
nsDS5ReplicaHost: ds.example.com
nsDS5ReplicaUpdateSchedule: *
nsDS5ReplicaTransportInfo: LDAP
objectClass: top
objectClass: nsDS5ReplicationAgreement
nsDS5ReplicaPort: 389
nsDS5ReplicaBindMethod: SIMPLE
cn: ds.example.com:389
nsDS5ReplicaRoot: dc=example,dc=com
nsDS5ReplicaBindDN: cn=replication manager,cn=replication,
 cn=config
nsDS5ReplicaCredentials:: e0RFU31JakduS3VZSWhEcThEcExDQlU2
 VlN2QTdjcUw4emhDdXl3Sldmc3NTZ2t3eS9mWmR4VmpUZlVYRE1NLzR2T
 UVBDQpyZVdYU3A3U1ZwYz0=

In this example, the key attributes are the following:

nsDS5ReplicaHost

Holds the host name where the consumer runs.

nsDS5ReplicaUpdateSchedule

Specifies when replication happens. If you must restrict the time when replication can happen, set this attribute. This attribute can take multiple values of the form hhmm-hhmm 0123456, where the first element specifies the time span, and the second specifies which days, starting with Sunday (0) to Saturday (6).

nsDS5ReplicaTransportInfo

Specifies the transport used for replication, LDAP or SSL.

nsDS5ReplicaPort

Holds port number on which the consumer listens.

cn

This attribute names the replication agreement. Once set, it must not be modified.

nsDS5ReplicaBindMethod

Specifies bind protocol, SIMPLE, SSLCLIENTAUTH.

nsDS5ReplicaRoot

Holds the DN of the root of the replicated suffix. Once set, it must not be modified.

nsDS5ReplicaBindDN

Holds the DN of the account on the consumer used for replication.

nsDS5ReplicaCredentials

Holds the bind credentials of the account on the consumer used for replication.

The replication agreement entry can also hold the following attributes not shown here:

description(5dsat)

ds5AgreementEnable(5dsconf)

ds5ReplicaAutomaticInit(5dsconf)

ds5ReplicaTransportCompressionLevel(5dsconf)

ds5ReplicaTransportConcurrencyLevel(5dsconf)

ds5ReplicaTransportGroupSize(5dsconf)

ds5ReplicaTransportGrpPktSize(5dsconf)

ds5ReplicaTransportWindowSize(5dsconf)

ds6ruv(5dsconf)

dsReplFractionalExclude(5dsconf)

dsReplFractionalInclude(5dsconf)

nsDS5ReplicaUpdateSchedule(5dsconf)

nsds50ruv(5dsconf)

nsds5BeginReplicaRefresh(5dsconf)

nsds5ReplicaTimeout(5dsconf)

nsds5replicaChangesSentSinceStartup(5dsconf)

nsds5replicaLastInitEnd(5dsconf)

nsds5replicaLastInitStart(5dsconf)

nsds5replicaLastInitStatus(5dsconf)

nsds5replicaLastUpdateEnd(5dsconf)

nsds5replicaLastUpdateStart(5dsconf)

nsds5replicaLastUpdateStatus(5dsconf)

nsds5replicaUpdateInProgress(5dsconf)

Supplier Priority Rule

For a master supplier, a ReplPriorityRule configuration entry looks something like the following:

dn: cn=pwdReplPrio,cn=replica,cn=dc\=example\,dc\=com,cn=mapping tree,cn=config
objectClass: top
objectClass: ReplPriorityRule
replPriorityType: mod
replPriorityAttribute: userPassword
nsDS5ReplicaRoot: dc=example,dc=com
cn: pwdReplPrio

In this example, the key attributes are the following:

replPriorityType

Specifies the type of operation which are replicated with high priority.

replPriorityAttribute

Specifies the attribute whose changes are replicated with high priority.

nsDS5ReplicaRoot

Holds the DN of the root of the replicated suffix to which this priority rule applies.

cn

This attribute names the priority rule.

The replication priority rule entry can also hold the following attributes not shown here:

replPriorityBaseDN(5dsconf)

replPriorityBindDN(5dsconf)

Consumer Side Configuration

On the consumer side, the key configuration entry is the replica configuration. On a dedicated consumer, it is also useful to see how the mapping tree entry for the suffix is configured to refer updates to the supplier.

Consumer Replica Configuration

For a dedicated consumer, an nsDS5Replica configuration entry looks something like the following:

dn: cn=replica,cn=dc\=example\,dc\=com,cn=mapping tree,cn=config
nsDS5ReplicaRoot: dc=example,dc=com
nsDS5ReplicaBindDN: cn=replication manager,cn=replication,cn=config
objectClass: top
objectClass: nsDS5Replica
nsDS5Flags: 0
nsDS5ReplicaType: 2
cn: replica
nsDS5ReplicaId: 65535
nsState:: //8AAAAAAAAAAAAAQ4rtPAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAA==
nsDS5ReplicaName: 07ed9f82-600411da-8096d729-0ba76005
dsFilterSPConfigchecksum: 0
ds5LastInitTimeStamp: 0

Key attributes in this example are explained in Supplier Replica Configuration.

A hub uses the same replica ID as a consumer, 65535.

Referrals On Consumer

For a dedicated consumer suffix, the mapping tree configuration entry refers client applications to the supplier for write operations:

dn: cn=dc\=example\,dc\=com,cn=mapping tree,cn=config
objectClass: top
objectClass: extensibleObject
objectClass: nsMappingTree
nsslapd-backend: example
cn: dc=example,dc=com
numSubordinates: 1
nsslapd-referral: ldap://master.example.com:389/dc%3Dexample,dc%3Dcom
nsslapd-state: referral on update

Notice that the nsslapd-referral attribute refers clients to the master on host master.example.com and port 389 when they request update operations that would write to the directory. These attributes are set by the server when replication is initialized. The dedicated consumer then accepts write operations only from the supplier replica.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dsconf(1M), person(5dsoc), pwpolicy(5dssd)

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Extended Description | Attributes | See Also

nsDS5ReplicaTombstonePurgeInterval(5dsconf)

Name | Description | Examples | Attributes | See Also

Name

nsDS5ReplicaTombstonePurgeInterval – Time interval between tombstone purge operations

Description

PROPERTY	VALUE
Entry DN	cn=replica,cn=suffix name,cn=mapping tree,cn=config
Valid Range	0 to maximum integer (seconds)
Default Value	300 (five minutes)
Syntax	Integer

This attribute is part of replica configuration for nsDS5Replica entries.

When this attribute is set, the server waits the number of seconds you specify after each operation to purge tombstone entries. Bear in mind that purge operations can be time consuming.

Examples

nsDS5ReplicaTombstonePurgeInterval: 300

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

replication(5dsconf)

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Examples | Attributes | See Also

nsDS5ReplicaTransportInfo(5dsconf)

Name | Description | Examples | Attributes | See Also

Name

nsDS5ReplicaTransportInfo – Transport used for replication

Description

PROPERTY	VALUE
Entry DN	cn=agreement name,cn=replica,cn=suffix name,cn=mapping tree,cn=config
Valid Range	LDAP | SSL
Default Value	N/A
Syntax	DirectoryString

This attribute is part of replica configuration for nsDS5ReplicationAgreement entries.

Specifies the type of transport used for replication. When this attribute is set to LDAP, standard LDAP connections are used. When this attribute is set to SSL, LDAPS connections are used. Do not modify this attribute after it has been set.

Examples

nsDS5ReplicaTransportInfo: SSL

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

replication(5dsconf)

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Examples | Attributes | See Also

nsDS5ReplicaType(5dsconf)

Name | Description | Examples | Attributes | See Also

Name

nsDS5ReplicaType – Role of the replica

Description

PROPERTY	VALUE
Entry DN	cn=replica,cn=suffix name,cn=mapping tree,cn=config
Valid Range	0 | 1 | 2 | 3
Default Value	3 (master), 2 (consumer)
Syntax	Integer

This attribute is part of replica configuration for nsDS5Replica entries.

When this attribute is set, the server starts accepting client updates after waiting the number of seconds you specify.

Examples

nsDS5ReplicaType: 3

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

replication(5dsconf)

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Examples | Attributes | See Also

nsds5replicaUpdateInProgress(5dsconf)

Name | Description | Examples | Attributes

Name

nsds5replicaUpdateInProgress – Indicate whether or not a replication schedule update is in progress

Description

PROPERTY	VALUE
Entry DN	cn=Replication Agreement Name,cn=replica,cn=Suffix Name, cn=mapping tree,cn=config
Valid Range	true | false
Default Value	None
Syntax	Boolean

This read-only attribute states whether or not a replication schedule update is in progress.

Examples

nsds5replicaUpdateInProgress: true

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Unstable

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Examples | Attributes

nsDS5ReplicaUpdateSchedule(5dsconf)

Name | Description | Examples | See Also | Attributes

Name

nsDS5ReplicaUpdateSchedule – When replication is scheduled

Description

PROPERTY	VALUE
Entry DN	cn=agreement name,cn=replica,cn=suffix name,cn=mapping tree,cn=config
Valid Range	hhmm-hhmm 0123456 | *
Default Value	*
Syntax	DirectoryString

This attribute is part of replica configuration for nsDS5ReplicationAgreement entries.

When set to *, this attribute causes the supplier to replicate as necessary. This attribute can alternatively take multiple values of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, then finishing hour in 24-hour time format, from 0000-2359, and the second specifies which days, starting with Sunday (0) to Saturday (6).

Examples

The following setting specifies the supplier should replicate to the consumer between midnight and 4 am on Sundays, Tuesdays, Thursdays, and Saturdays:

nsDS5ReplicaUpdateSchedule: 0000-0400 0246

See Also

replication(5dsconf)

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Examples | See Also | Attributes

nsDS5Task(5dsconf)

Name | Description | Examples | Attributes | See Also

Name

nsDS5Task – Internal replication tasks

Description

PROPERTY	VALUE
Entry DN	cn=replica,cn=suffix name,cn=mapping tree,cn=config
Valid Range	N/A
Default Value	None
Syntax	DirectoryString

This attribute is part of replica configuration for nsDS5Replica entries.

This attribute is reserved for internal use.

Examples

nsDS5Task: CL2LDIF

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

replication(5dsconf)

ODSEE 11.1.1.3.0  Last Revised March 1, 2010

Name | Description | Examples | Attributes | See Also

nsFarmServerURL(5dsconf)

Name | Description | Attributes | See Also

Name

nsFarmServerURL – LDAP URL for chaining farm server

Description

The LDAP URL of the remote server. A farm server is contains data in one or more databases. This attribute can contain optional servers for failover, separated by spaces. For cascading chaining, this URL can point to another chained suffix.

Entry DN

cn=chainedSuffix,cn=chaining database, cn=plugins,cn=config

Valid Range

Any valid remote server LDAP URL.

Default Value

N/A

Syntax

DirectoryString

Example

nsFarmServerURL: ldap://epdiote.example.com:alternate_server:3333

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 6, 2006

Name | Description | Attributes | See Also

nshoplimit(5dsconf)

Name | Description | Attributes | See Also

Name

nshoplimit – maximum hops for chaining

Description

Specifies the maximum number of times a suffix is allowed to chain, that is, the number of times a request can be forwarded from one chained suffix to another.

Entry DN

cn=chainedSuffix,cn=chaining database, cn=plugins,cn=config

Valid Range

1 to an appropriate upper limit for your deployment.

Default Value

10

Syntax

Integer

Example

nsHopLimit: 3

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 6, 2006

Name | Description | Attributes | See Also

nsIndexType(5dsconf)

Name | Description | Attributes | See Also

Name

nsIndexType – type of index

Description

This optional, multivalued attribute specifies the types of index used in Directory Server operations and the values of the attributes to be indexed. Each index type must be entered on a separate line.

Entry DN

cn=default indexes,cn=config,cn=ldbm database, cn=plugins,cn=config

Valid Range

approx

Approximate, sounds alike, index

browse

Virtual list view index

eq

Equality index

matching rule

Matching rule index

pres

Presence index

sub

Substring index

Default Value

Not applicable

Syntax

DirectoryString

Example

nsindextype: eq

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 6, 2006

Name | Description | Attributes | See Also

nsLookthroughLimit(5dsconf)

Name | Description | Attributes | See Also

Name

nsLookthroughLimit – maximum number of entries checked during search

Description

This performance-related attribute specifies the maximum number of entries that Directory Server checks when examining candidate entries in response to a search request. If you bind as Directory Manager, unlimited is set by default and overrides any other settings you may specify here.

Binder based resource limits work for this limit, which means that if a value for the operational attribute nsLookThroughlimit is present in the entry used to bind, the default limit is overridden. If you attempt to set a value that is not a number or is too big for a 64-bit signed integer, you receive an LDAP_UNWILLING_TO_PERFORM error message with additional error information explaining the problem.

Entry DN

cn=config,cn=ldbm database,cn=plugins,cn=config

Valid Range

-1 to the maximum number of entries, where -1 is unlimited

Default Value

5000

Syntax

Integer

Example

nsLookthroughLimit: 5000

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 6, 2006

Name | Description | Attributes | See Also

nsMatchingRule(5dsconf)

Name | Description | Attributes | See Also

Name

nsMatchingRule – collation order OID for international index

Description

This optional, multivalued attribute specifies the collation order object identifier, OID, required for Directory Server to operate international indexing.

Entry DN

cn=default indexes,cn=monitor,cn=ldbm database, cn=plugins,cn=config

Valid Range

Any valid collation order object identifier (OID)

Default Value

None

Syntax

DirectoryString

Example

nsMatchingRule: 1.3.6.1.4.1.42.2.27.9.4.23.1

(For Bulgarian)

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 6, 2006

Name | Description | Attributes | See Also

nsMaxResponseDelay(5dsconf)

Name | Description | Attributes | See Also

Name

nsMaxResponseDelay – maximum delay for chained response

Description

This error detection, performance related attribute specifies the maximum period of time it can take a remote server to respond to an LDAP operation request made by a chained suffix before an error is suspected. Once this delay period has been met, the chained suffix tests the connection with the remote server.

Entry DN

cn=config,cn=chaining database,cn=plugins,cn=config

Valid Range

Any valid delay period in seconds.

Default Value

60 seconds

Syntax

Integer

Example

nsMaxResponseDelay: 60

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 6, 2006

Name | Description | Attributes | See Also

nsMaxTestResponseDelay(5dsconf)

Name | Description | Attributes | See Also

Name

nsMaxTestResponseDelay – maximum delay to test chaining response

Description

This error detection, performance related attribute specifies the duration of the test issued by the chained suffix to check whether the remote server is responding. If a response from the remote server is not returned within this period, the chained suffix assumes the remote server is down and the connection is not used for subsequent operations.

Entry DN

cn=config,cn=chaining database,cn=plugins,cn=config

Valid Range

Any valid delay period in seconds.

Default Value

15 seconds

Syntax

Integer

Example

nsMaxTestResponseDelay: 15

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 6, 2006

Name | Description | Attributes | See Also

nsMultiplexorBindDN(5dsconf)

Name | Description | Attributes | See Also

Name

nsMultiplexorBindDN – bind DN for chaining multiplexor

Description

DN of the administrative entry used to communicate with the remote server. The multiplexor is the server that contains the chained suffix and communicates with the farm server. This bind DN cannot be the Directory Manager. If this attribute is not specified, the chained suffix binds as anonymous.

Entry DN

cn=chainedSuffix,cn=chaining database, cn=plugins,cn=config

Valid Range

Not applicable

Default Value

DN of the multiplexor.

Syntax

DirectoryString

Example

nsMultiplexorBindDN: cn=proxy manager

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 6, 2006

Name | Description | Attributes | See Also

nsMultiplexorCredentials(5dsconf)

Name | Description | Attributes | See Also

Name

nsMultiplexorCredentials – bind password for chaining multiplexor

Description

Password for the administrative user, in plain text. If no password is provided, users can bind as anonymous. The password is encrypted in the configuration file. Please note that the example below is what you view , not what you type.

Entry DN

cn=chainedSuffix,cn=chaining database, cn=plugins,cn=config

Valid Range

Any valid password (that is encrypted using the DES reversible password encryption schema.)

Default Value

Not applicable

Syntax

DirectoryString

Example

nsMultiplexorCredentials: {DES} 9Eko69APCJfF

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 6, 2006

Name | Description | Attributes | See Also

nsOperationConnectionsLimit(5dsconf)

Name | Description | Attributes | See Also

Name

nsOperationConnectionsLimit – maximum number of LDAP connections for chaining

Description

Maximum number of LDAP connections the chained suffix establishes with the remote server.

Entry DN

cn=default instance config,cn=chaining database, cn=plugins,cn=config

Valid Range

1 to 20 connections

Default Value

10

Syntax

Integer

Example

nsoperationconnectionslimit:10

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 6, 2006

Name | Description | Attributes | See Also

nsProxiedAuthorization(5dsconf)

Name | Description | Attributes | See Also

Name

nsProxiedAuthorization – disable proxy authorization for chaining

Description

Reserved for advanced use only, this attribute permits you to disable proxied authorization. A value of off means that proxied authorization is disabled, and that all binds for chained operations are executed as the user specified in nsMultiplexorBindDN.

Entry DN

cn=default instance config,cn=chaining database, cn=plugins,cn=config

Valid Range

on | off

Default Value

on

Syntax

DirectoryString

Example

nsproxiedauthorization: on

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 6, 2006

Name | Description | Attributes | See Also

nsReferralOnScopedSearch(5dsconf)

Name | Description | Attributes | See Also

Name

nsReferralOnScopedSearch – referrals for chained searches

Description

Controls whether referrals are returned for searches with scope of one level or subtree. When nsReferralOnScopedSearch is set to on, Directory Server returning referrals for such searches, instead of chaining the searches, allowing clients that can handle referrals to access the appropriate directory directly.

Entry DN

cn=default instance config,cn=chaining database, cn=plugins,cn=config

Valid Range

on | off

Default Value

off

Syntax

DirectoryString

Example

nsreferralonscopedsearch: off

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 6, 2006

Name | Description | Attributes | See Also

nsslapd-accesscontrol(5dsconf)

Name | Description | Examples | Attributes

Name

nsslapd-accesscontrol – Turn access control on and off

Description

PROPERTY	VALUE
Entry DN	cn=config
Valid Range	on|off
Default Value	on
Syntax	DirectoryString

This attribute turns access control on and off. If this attribute has a value off, any valid bind attempt including an anonymous bind results in full access to all information stored in Directory Server.

---

Note –

Do not set this attribute to off unless you are told to do so by technical support personnel.

---

Examples

nsslapd-accesscontrol: on

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Unstable

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Examples | Attributes

nsslapd-accesslog(5dsconf)

Name | Description | Examples | Attributes

Name

nsslapd-accesslog, nsslapd-auditlog, nsslapd-errorlog – Specify the path and filename of the access|audit|error log

Description

PROPERTY	VALUE
Entry DN	cn=config
Valid Range	Any valid file name
Default Value	See description that follows.
Syntax	DirectoryString

These attributes specify the path and filename of the log used to record each database access. Default values are:

install-path/logs/access

install-path/logs/audit

install-path/logs/errors

The following information is recorded in the access log file by default:

• IP address of the client machine that accessed the database

• Operations performed such as search, add, modify

• Result of the access such as the number of entries returned for a search

The information recorded in the error log depends on the error log level but typically contains at least the server startup and shutdown times, and the server port number.

For logging to be enabled, both of the following conditions must be met:

• The nsslapd-*log attribute must be set to a valid file name.

• The nsslapd-*log-logging-enabled attribute must be set to on.

Other configurations result in logging being disabled.

Examples

nsslapd-accesslog: /local/dsInst/logs/access
nsslapd-auditlog: /local/dsInst/logs/audit
nsslapd-errorlog: /local/dsInst/logs/errors

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Stable

ODSEE 11.1.1.3.0  Last Revised March 1, 2010

Name | Description | Examples | Attributes

nsslapd-accesslog-level(5dsconf)

Name | Description | Examples | Attributes

Name

nsslapd-accesslog-level, nsslapd-auditlog-level, nsslapd-errorlog-level – Control what is logged to the access, audit, or error log

Description

PROPERTY	VALUE
Entry DN	cn=config
Valid Range	See the description that follows.
Default Value	256
Syntax	Integer

This attribute specifies the access log levels. Log levels can be added together to provide you with the exact type of logging you require. For example, 516 (4 + 512) obtains the internal access operation, entry access, and referral logging. The following levels are supported:

0

No access logging

4

Logging for internal access operations

256

Logging for access to an entry

512

Logging for access to an entry and referrals

131072

Precise timing of operation duration. This gives microsecond resolution for the elapsed time item in the access log.

Examples

nsslapd-accesslog-level: 256

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Unstable

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Examples | Attributes

nsslapd-accesslog-list(5dsconf)

Name | Description | Examples | Attributes

Name

nsslapd-accesslog-list, nsslapd-auditlog-list, nsslapd-errorlog-list – Provide a list of log files used in access, audit, or error log rotation.

Description

PROPERTY	VALUE
Entry DN	cn=config
Valid Range	Not applicable
Default Value	None
Syntax	DirectoryString

This attribute provides a list of log files used in access, audit, or error log rotation. This attribute is read only and cannot be set.

Examples

nsslapd-accesslog-list:accesslog2,accesslog3

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Unstable

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Examples | Attributes

nsslapd-accesslog-logbuffering(5dsconf)

Name | Description | Examples | Attributes

Name

nsslapd-accesslog-logbuffering, nsslapd-auditlog-logbuffering, nsslapd-errorlog-logbuffering – Determines whether the server writes access log entries directly to disk

Description

PROPERTY	VALUE
Entry DN	cn=config
Valid Range	on|off
Default Value	on
Syntax	DirectoryString

When this attribute is set to off, the server writes all access log entries directly to disk.

Examples

nsslapd-accesslog-logbuffering: off

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Unstable

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Examples | Attributes

nsslapd-accesslog-logexpirationtime(5dsconf)

Name | Description | Examples | Attributes

Name

nsslapd-accesslog-logexpirationtime, nsslapd-auditlog-logexpirationtime, nsslapd-errorlog-logexpirationtime – Specify the maximum age that an access, audit, or error log file is allowed to reach before it is deleted

Description

PROPERTY	VALUE
Entry DN	cn=config
Valid Range	1 to the maximum 32–bit integer value (2147483647)
Default Value	1
Syntax	Integer

Specifies the maximum age that an access, audit, or error log file is allowed to reach before it is deleted. This attribute supplies only the number of units. The units are provided by the nsslapd-accesslog-logexpirationtimeunit, nsslapd-auditlog-logexpirationtimeunit, or nsslapd-errorlog-logexpirationtimeunit attribute.

Examples

nsslapd-accesslog-logexpirationtime: 2

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Unstable

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Examples | Attributes

nsslapd-accesslog-logexpirationtimeunit(5dsconf)

Name | Description | Examples | Attributes

Name

nsslapd-accesslog-logexpirationtimeunit, nsslapd-auditlog-logexpirationtimeunit, nsslapd-errorlog-logexpirationtimeunit – Determines the unit of the log expiration time

Description

Property	Value
Entry DN	cn=config
Valid Range	month | week | day
Default Value	month
Syntax	DirectoryString

Specifies the unit for the nsslapd-accesslog-logexpirationtime, nsslapd-auditlog-logexpirationtime, or nsslapd-errorlog-logexpirationtime attribute. If the unit is unknown by the server, the log will never expire.

Examples

nsslapd-accesslog-logexpirationtimeunit: day

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Unstable

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Examples | Attributes

nsslapd-accesslog-logging-enabled(5dsconf)

Name | Description | Attributes

Name

nsslapd-accesslog-logging-enabled, nsslapd-auditlog-logging-enabled, nsslapd-errorlog-logging-enabled – Enable or disable access, audit, or error logging

Description

PROPERTY	VALUE
Entry DN	cn=config
Valid Range	on|off
Default Value	Access logging on, Audit logging off
Syntax	DirectoryString

This attribute is used in conjunction with the nsslapd-accesslog, nsslapd-auditlog, or nsslapd-errorlog attribute to disable and enable access, audit, or error logging. The nsslapd-accesslog, nsslapd-auditlog, or nsslapd-errorlog attributes specify the path and filename of the access, audit, and error logs, respectively.

For logging to be enabled, the nsslapd-accesslog-logging-enabled, nsslapd-auditlog-logging-enabled, or nsslapd-errorlog-logging-enabled attribute must be switched to on, and the respective nsslapd-accesslog, nsslapd-auditlog, or nsslapd-errorlog attribute must have a valid path and filename.

For information about the combinations of values for these attributes, see the nsslapd-accesslog, nsslapd-auditlog, or nsslapd-errorlog man page.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Unstable

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Attributes

nsslapd-accesslog-logmaxdiskspace(5dsconf)

Name | Description | Examples | Attributes

Name

nsslapd-accesslog-logmaxdiskspace, nsslapd-auditlog-logmaxdiskspace, nsslapd-errorlog-logmaxdiskspace – Specify the maximum amount of disk space in megabytes that the access, audit or error logs are allowed to consume

Description

PROPERTY	VALUE
Entry DN	cn=config
Valid Range	-1 | 1 to the maximum 32–bit integer value (2147483647). A value of -1 means that the disk space allowed for the log is unlimited in size.
Default Value	Access logs 500, audit logs and error logs 100
Syntax	Integer

Specifies the maximum amount of disk space in megabytes that the access, audit or error logs are allowed to consume. If this value is exceeded, the oldest access, audit or error log is deleted.

When setting the maximum disk space, consider the total number of log files that can be created due to log file rotation. As there are three different log files – access log, audit log, and error log – maintained by Directory Server, each of which consume disk space. Compare these considerations to the total amount of disk space that you want to be used by the each log.

Examples

nsslapd-accesslog-logmaxdiskspace: 200

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Unstable

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Examples | Attributes

nsslapd-accesslog-logminfreediskspace(5dsconf)

Name | Description | Examples | Attributes

Name

nsslapd-accesslog-logminfreediskspace, nsslapd-auditlog-logminfreediskspace, nsslapd-errorlog-logminfreediskspace – Specify the minimum amount of free disk space in megabytes that is allowed before an access, audit, or error log is deleted

Description

PROPERTY	VALUE
Entry DN	cn=config
Valid Range	1 to the maximum 32–bit integer value (2147483647)
Default Value	5
Syntax	Integer

Specifies the minimum amount of free disk space in megabytes that is allowed before an access, audit, or error log is deleted. When the amount of free disk space falls below the value specified by this attribute, the oldest access, audit, or error log is deleted until enough disk space is freed to satisfy this attribute.

Examples

nsslapd-accesslog-logminfreediskspace: 4

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Unstable

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Examples | Attributes

nsslapd-accesslog-logrotationtime(5dsconf)

Name | Synopsis | Description | Examples | Attributes

Name

nsslapd-accesslog-logrotationtime, nsslapd-auditlog-logrotationtime, nsslapd-errorlog-logrotationtime – Specify the time interval, the time of the day, and the minimum file size for rotation of the access log, audit log, or error log

Synopsis

nsslapd-accesslog-logrotationtime:
 {time-interval}  [time-of-day | *]  [min-file-size | *]

Description

PROPERTY	VALUE
Entry DN	cn=config
Valid Range	See description that follows.
Default Value	1 * *
Syntax	DirectoryString

This attribute specifies the time interval, the time of the day, and the minimum file size for access, audit, or error rotation. The unit of the time interval is specified by the nsslapd-accesslog-logrotationtimeunit, nsslapd-auditlog-logrotationtimeunit, or nsslapd-errorlog-logrotationtimeunit attribute.

The valid range for this attribute is as follows.

• time-interval

  Time interval at which the log is rotated. The unit of the time interval is given by the nsslapd-auditlog-logrotationtimeunit attribute.

• time-of-day

  Time of the day, on a 24-hour clock, at which the log is rotated.

  The value * means that no time of day is specified.

• min-file-size

  Minimum file size in kilobytes at which the log file is rotated. The log file is rotated if the file size is greater than the specified number of kilobytes.

  The value * means that no minimum file size is specified.

This attribute must be used in conjunction with the nsslapd-accesslog-logrotationtimeunit, nsslapd-auditlog-logrotationtimeunit, or nsslapd-errorlog-logrotationtimeunit attribute.

Examples

---

Example 1 To Rotate the Access Log at 11:30 pm Every Day Regardless of the Size of the Log File




To specify when the access log is rotated, the nsslapd-accesslog-logrotationtime and the nsslapd-accesslog-logrotationtimeunit attributes must be set.

To rotate the log daily, the nsslapd-accesslog-logrotationtimeunit must be set as follows:

nsslapd-accesslog-logrotationtimeunit: day

To rotate the log at 11:30 pm daily, the nsslapd-accesslog-logrotationtime must be set as follows:

nsslapd-accesslog-logrotationtime: 1 2330

The min-file-size is not specified, therefore,the log is rotated irrespective of the file size.

---

---

Example 2 To Rotate the Error Log at 11:30 pm Every Day if the File Size is Greater Than 10 KB




To specify when the error log is rotated, the nsslapd-errorlog-logrotationtime and the nsslapd-errorlog-logrotationtimeunit attributes must be set.

To rotate the log daily, the nsslapd-accesslog-logrotationtimeunit must be set as follows:

nsslapd-accesslog-logrotationtimeunit: day

To rotate the log at 11:30 pm daily if the file size is greater than 10 KB, the nsslapd-accesslog-logrotationtime must be set as follows:

nsslapd-accesslog-logrotationtime: 1 2330 10

---

---

Example 3 To Rotate the Error Log at Any Time if the File Size is Greater Than 10 KB




To specify when the error log is rotated, the nsslapd-errorlog-logrotationtime and the nsslapd-errorlog-logrotationtimeunit attributes must be set.

To rotate the log every minute if the file size is greater the 10 KB, the nsslapd-errorlog-logrotationtimeunit attribute must be set as follows:

nsslapd-accesslog-logrotationtimeunit: Minute

To rotate the log when the file size is greater than 10 KB , the nsslapd-errorlog-logrotationtime must be set as follows:

nsslapd-errorlog-logrotationtime: 1 * 10

The time-of-day is specified as *, therefore, no specific time of day is specified.

---

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Unstable

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Synopsis | Description | Examples | Attributes

nsslapd-accesslog-logrotationtimeunit(5dsconf)

Name | Description | Attributes

Name

nsslapd-accesslog-logrotationtimeunit, nsslapd-auditlog-logrotationtimeunit, nsslapd-errorlog-logrotationtimeunit – Specify the unit for the time-interval part of the nsslapd-access|audit|errorlog-logrotationtime attribute

Description

PROPERTY	VALUE
Entry DN	cn=config
Valid Range	Month | Week | Day | Hour | Minute
Default Value	Day
Syntax	DirectoryString

Specifies the unit for the time-interval part of the nsslapd-access|audit|errorlog-logrotationtime attribute.

This attribute must be used in conjunction with the nsslapd-access|audit|errorlog-logrotationtime attribute.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Unstable

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Attributes

nsslapd-accesslog-maxlogsize(5dsconf)

Name | Description | Attributes

Name

nsslapd-accesslog-maxlogsize, nsslapd-auditlog-maxlogsize, nsslapd-errorlog-maxlogsize – Specify the maximum size of the access, audit, or error log in megabytes

Description

PROPERTY	VALUE
Entry DN	cn=config
Valid Range	-1 | 1 to the maximum 32–bit integer value (2147483647). A value of -1 means the log file is unlimited in size.
Default Value	100
Syntax	Integer

This attribute specifies the maximum size of the access, audit, or error log in megabytes. When this value is reached, the log is rotated.

If the nsslapd-accesslog-maxlogsperdir, nsslapd-auditlog-maxlogsperdir, or nsslapd-errorlog-maxlogsperdir attribute is set to 1, the server ignores the respective nsslapd-accesslog-maxlogsize, nsslapd-auditlog-maxlogsize, or nsslapd-errorlog-maxlogsize attribute.

When you set a maximum log size, consider the total number of log files that can be created due to log file rotation. Also, remember that there are three different log files (access log, audit log, and error log) maintained by Directory Server, each of which will consume disk space. Compare these considerations to the total amount of disk space that you want to be used by the log.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Unstable

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Attributes

nsslapd-accesslog-maxlogsperdir(5dsconf)

Name | Description | Attributes

Name

nsslapd-accesslog-maxlogsperdir, nsslapd-auditlog-maxlogsperdir, nsslapd-errorlog-maxlogsperdir – Specify the total number of access, audit, or error logs that can be contained in the access, audit, or error logs directory

Description

PROPERTY	VALUE
Entry DN	cn=config
Valid Range	1 to the maximum 32–bit integer value (2147483647)
Default Value	10
Syntax	Integer

This attribute specifies the total number of access, audit, or error logs that can be contained in the respective directory.

Each time the access log is rotated, a new log file is created. When the number of files contained in the access log directory exceeds the value stored on this attribute, the oldest version of the log file is deleted. The same scenario is true for audit logs and error logs.

If you set this value to 1, the server will not rotate the log and it will grow indefinitely.

If the value for this attribute is higher than 1, check the nsslapd-accesslog-logrotationtime,nsslapd-auditlog-logrotationtime, or nsslapd-errorlog-logrotationtime attribute to establish whether or not log rotation is specified.

If the nsslapd-accesslog-logrotationtime, nsslapd-auditlog-logrotationtime, or nsslapd-errorlog-logrotationtime attribute has a value of -1, there is no rotation of the respective log.

For more information, refer to the nsslapd-accesslog-logrotationtime, nsslapd-auditlog-logrotationtime, or nsslapd-errorlog-logrotationtime man page.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Unstable

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Attributes

nsslapd-accesslog-permissions(5dsconf)

Name | Synopsis | Description | Examples | Attributes

Name

nsslapd-accesslog-permissions, nsslapd-auditlog-permissions, nsslapd-errorlog-permissions – Specify the permissions for the log files

Synopsis

nsslapd-accesslog-permissions:  permissions

Description

PROPERTY	VALUE
Entry DN	cn=config
Valid Range	See description that follows.
Default Value	600
Syntax	UNIX style octal permissions.  Not supported on Windows platforms.

This attribute specifies the permissions for the log file.

Valid range is 001 to 777.

The permission 000 is not allowed because the server might have trouble starting for non-root users.

On Windows platforms, this attribute is ignored and a warning message is logged.

Examples

---

Example 1 To Set the Access Log Permssions to 644




nsslapd-accesslog-permissions:  644

---

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Unstable

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Synopsis | Description | Examples | Attributes

nsslapd-allidsthreshold(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-allidsthreshold – Maximum number of values per index key in an index list

Description

This attribute defines a threshold to limit the length of an index list. The threshold is called the index list threshold. If the number of entries in the list for a particular key exceeds the index list threshold, an unindexed search is performed.

The value of the nsslapd-allidsthreshold attribute can be configured globally for a Directory Server instance, or can be configured for a suffix, or can be configured for an index type. If the value of the nsslapd-allidsthreshold attribute is configured globally for a suffix, it can then be changed for a specific index.

You must rebuild all indexes after you change the nsslapd-allidsthreshold attribute.

Entry DN

cn=config,cn=ldbm database,cn=plugins,cn=config

Valid Range

0

The nsslapd-allidsthreshold attribute is not used. The global configured value is used.

<2000

Values less than 2000 are rounded up to 2000.

>2000

The value is the minimum guaranteed value. Because of internal mechanisms, the real value can be slightly more than the specified value.

-1

No limit

Default Value

4000

Syntax

Integer

Error Messages

LDAP_UNWILLING_TO_PERFORM means ou have set a value that is not a number or the value is too big for a 64-bit signed integer. Additional error information is provided to explain the problem.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 5, 2006

Name | Description | Attributes | See Also

nsslapd-attribute-name-exceptions(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-attribute-name-exceptions – allow non-standard characters in attribute names

Description

Allows non-standard characters in attribute names to be used for backward compatibility with older servers.

Entry DN

cn=config

Valid Range

on | off

Default Value

off

Syntax

DirectoryString

Example

nsslapd-attribute-name-exceptions: on

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 5, 2006

Name | Description | Attributes | See Also

nsslapd-auditlog(5dsconf)

Name | Description | Examples | Attributes

Name

nsslapd-accesslog, nsslapd-auditlog, nsslapd-errorlog – Specify the path and filename of the access|audit|error log

Description

PROPERTY	VALUE
Entry DN	cn=config
Valid Range	Any valid file name
Default Value	See description that follows.
Syntax	DirectoryString

These attributes specify the path and filename of the log used to record each database access. Default values are:

install-path/logs/access

install-path/logs/audit

install-path/logs/errors

The following information is recorded in the access log file by default:

• IP address of the client machine that accessed the database

• Operations performed such as search, add, modify

• Result of the access such as the number of entries returned for a search

The information recorded in the error log depends on the error log level but typically contains at least the server startup and shutdown times, and the server port number.

For logging to be enabled, both of the following conditions must be met:

• The nsslapd-*log attribute must be set to a valid file name.

• The nsslapd-*log-logging-enabled attribute must be set to on.

Other configurations result in logging being disabled.

Examples

nsslapd-accesslog: /local/dsInst/logs/access
nsslapd-auditlog: /local/dsInst/logs/audit
nsslapd-errorlog: /local/dsInst/logs/errors

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Stable

ODSEE 11.1.1.3.0  Last Revised March 1, 2010

Name | Description | Examples | Attributes

nsslapd-auditlog-level(5dsconf)

Name | Description | Examples | Attributes

Name

nsslapd-accesslog-level, nsslapd-auditlog-level, nsslapd-errorlog-level – Control what is logged to the access, audit, or error log

Description

PROPERTY	VALUE
Entry DN	cn=config
Valid Range	See the description that follows.
Default Value	256
Syntax	Integer

This attribute specifies the access log levels. Log levels can be added together to provide you with the exact type of logging you require. For example, 516 (4 + 512) obtains the internal access operation, entry access, and referral logging. The following levels are supported:

0

No access logging

4

Logging for internal access operations

256

Logging for access to an entry

512

Logging for access to an entry and referrals

131072

Precise timing of operation duration. This gives microsecond resolution for the elapsed time item in the access log.

Examples

nsslapd-accesslog-level: 256

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Unstable

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Examples | Attributes

nsslapd-auditlog-list(5dsconf)

Name | Description | Examples | Attributes

Name

nsslapd-accesslog-list, nsslapd-auditlog-list, nsslapd-errorlog-list – Provide a list of log files used in access, audit, or error log rotation.

Description

PROPERTY	VALUE
Entry DN	cn=config
Valid Range	Not applicable
Default Value	None
Syntax	DirectoryString

This attribute provides a list of log files used in access, audit, or error log rotation. This attribute is read only and cannot be set.

Examples

nsslapd-accesslog-list:accesslog2,accesslog3

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Unstable

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Examples | Attributes

nsslapd-auditlog-logbuffering(5dsconf)

Name | Description | Examples | Attributes

Name

nsslapd-accesslog-logbuffering, nsslapd-auditlog-logbuffering, nsslapd-errorlog-logbuffering – Determines whether the server writes access log entries directly to disk

Description

PROPERTY	VALUE
Entry DN	cn=config
Valid Range	on|off
Default Value	on
Syntax	DirectoryString

When this attribute is set to off, the server writes all access log entries directly to disk.

Examples

nsslapd-accesslog-logbuffering: off

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Unstable

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Examples | Attributes

nsslapd-auditlog-logexpirationtime(5dsconf)

Name | Description | Examples | Attributes

Name

nsslapd-accesslog-logexpirationtime, nsslapd-auditlog-logexpirationtime, nsslapd-errorlog-logexpirationtime – Specify the maximum age that an access, audit, or error log file is allowed to reach before it is deleted

Description

PROPERTY	VALUE
Entry DN	cn=config
Valid Range	1 to the maximum 32–bit integer value (2147483647)
Default Value	1
Syntax	Integer

Specifies the maximum age that an access, audit, or error log file is allowed to reach before it is deleted. This attribute supplies only the number of units. The units are provided by the nsslapd-accesslog-logexpirationtimeunit, nsslapd-auditlog-logexpirationtimeunit, or nsslapd-errorlog-logexpirationtimeunit attribute.

Examples

nsslapd-accesslog-logexpirationtime: 2

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Unstable

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Examples | Attributes

nsslapd-auditlog-logexpirationtimeunit(5dsconf)

Name | Description | Examples | Attributes

Name

nsslapd-accesslog-logexpirationtimeunit, nsslapd-auditlog-logexpirationtimeunit, nsslapd-errorlog-logexpirationtimeunit – Determines the unit of the log expiration time

Description

Property	Value
Entry DN	cn=config
Valid Range	month | week | day
Default Value	month
Syntax	DirectoryString

Specifies the unit for the nsslapd-accesslog-logexpirationtime, nsslapd-auditlog-logexpirationtime, or nsslapd-errorlog-logexpirationtime attribute. If the unit is unknown by the server, the log will never expire.

Examples

nsslapd-accesslog-logexpirationtimeunit: day

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Unstable

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Examples | Attributes

nsslapd-auditlog-logging-enabled(5dsconf)

Name | Description | Attributes

Name

nsslapd-accesslog-logging-enabled, nsslapd-auditlog-logging-enabled, nsslapd-errorlog-logging-enabled – Enable or disable access, audit, or error logging

Description

PROPERTY	VALUE
Entry DN	cn=config
Valid Range	on|off
Default Value	Access logging on, Audit logging off
Syntax	DirectoryString

This attribute is used in conjunction with the nsslapd-accesslog, nsslapd-auditlog, or nsslapd-errorlog attribute to disable and enable access, audit, or error logging. The nsslapd-accesslog, nsslapd-auditlog, or nsslapd-errorlog attributes specify the path and filename of the access, audit, and error logs, respectively.

For logging to be enabled, the nsslapd-accesslog-logging-enabled, nsslapd-auditlog-logging-enabled, or nsslapd-errorlog-logging-enabled attribute must be switched to on, and the respective nsslapd-accesslog, nsslapd-auditlog, or nsslapd-errorlog attribute must have a valid path and filename.

For information about the combinations of values for these attributes, see the nsslapd-accesslog, nsslapd-auditlog, or nsslapd-errorlog man page.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Unstable

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Attributes

nsslapd-auditlog-logmaxdiskspace(5dsconf)

Name | Description | Examples | Attributes

Name

nsslapd-accesslog-logmaxdiskspace, nsslapd-auditlog-logmaxdiskspace, nsslapd-errorlog-logmaxdiskspace – Specify the maximum amount of disk space in megabytes that the access, audit or error logs are allowed to consume

Description

PROPERTY	VALUE
Entry DN	cn=config
Valid Range	-1 | 1 to the maximum 32–bit integer value (2147483647). A value of -1 means that the disk space allowed for the log is unlimited in size.
Default Value	Access logs 500, audit logs and error logs 100
Syntax	Integer

Specifies the maximum amount of disk space in megabytes that the access, audit or error logs are allowed to consume. If this value is exceeded, the oldest access, audit or error log is deleted.

When setting the maximum disk space, consider the total number of log files that can be created due to log file rotation. As there are three different log files – access log, audit log, and error log – maintained by Directory Server, each of which consume disk space. Compare these considerations to the total amount of disk space that you want to be used by the each log.

Examples

nsslapd-accesslog-logmaxdiskspace: 200

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Unstable

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Examples | Attributes

nsslapd-auditlog-logminfreediskspace(5dsconf)

Name | Description | Examples | Attributes

Name

nsslapd-accesslog-logminfreediskspace, nsslapd-auditlog-logminfreediskspace, nsslapd-errorlog-logminfreediskspace – Specify the minimum amount of free disk space in megabytes that is allowed before an access, audit, or error log is deleted

Description

PROPERTY	VALUE
Entry DN	cn=config
Valid Range	1 to the maximum 32–bit integer value (2147483647)
Default Value	5
Syntax	Integer

Specifies the minimum amount of free disk space in megabytes that is allowed before an access, audit, or error log is deleted. When the amount of free disk space falls below the value specified by this attribute, the oldest access, audit, or error log is deleted until enough disk space is freed to satisfy this attribute.

Examples

nsslapd-accesslog-logminfreediskspace: 4

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Unstable

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Examples | Attributes

nsslapd-auditlog-logrotationtime(5dsconf)

Name | Synopsis | Description | Examples | Attributes

Name

nsslapd-accesslog-logrotationtime, nsslapd-auditlog-logrotationtime, nsslapd-errorlog-logrotationtime – Specify the time interval, the time of the day, and the minimum file size for rotation of the access log, audit log, or error log

Synopsis

nsslapd-accesslog-logrotationtime:
 {time-interval}  [time-of-day | *]  [min-file-size | *]

Description

PROPERTY	VALUE
Entry DN	cn=config
Valid Range	See description that follows.
Default Value	1 * *
Syntax	DirectoryString

This attribute specifies the time interval, the time of the day, and the minimum file size for access, audit, or error rotation. The unit of the time interval is specified by the nsslapd-accesslog-logrotationtimeunit, nsslapd-auditlog-logrotationtimeunit, or nsslapd-errorlog-logrotationtimeunit attribute.

The valid range for this attribute is as follows.

• time-interval

  Time interval at which the log is rotated. The unit of the time interval is given by the nsslapd-auditlog-logrotationtimeunit attribute.

• time-of-day

  Time of the day, on a 24-hour clock, at which the log is rotated.

  The value * means that no time of day is specified.

• min-file-size

  Minimum file size in kilobytes at which the log file is rotated. The log file is rotated if the file size is greater than the specified number of kilobytes.

  The value * means that no minimum file size is specified.

This attribute must be used in conjunction with the nsslapd-accesslog-logrotationtimeunit, nsslapd-auditlog-logrotationtimeunit, or nsslapd-errorlog-logrotationtimeunit attribute.

Examples

---

Example 1 To Rotate the Access Log at 11:30 pm Every Day Regardless of the Size of the Log File




To specify when the access log is rotated, the nsslapd-accesslog-logrotationtime and the nsslapd-accesslog-logrotationtimeunit attributes must be set.

To rotate the log daily, the nsslapd-accesslog-logrotationtimeunit must be set as follows:

nsslapd-accesslog-logrotationtimeunit: day

To rotate the log at 11:30 pm daily, the nsslapd-accesslog-logrotationtime must be set as follows:

nsslapd-accesslog-logrotationtime: 1 2330

The min-file-size is not specified, therefore,the log is rotated irrespective of the file size.

---

---

Example 2 To Rotate the Error Log at 11:30 pm Every Day if the File Size is Greater Than 10 KB




To specify when the error log is rotated, the nsslapd-errorlog-logrotationtime and the nsslapd-errorlog-logrotationtimeunit attributes must be set.

To rotate the log daily, the nsslapd-accesslog-logrotationtimeunit must be set as follows:

nsslapd-accesslog-logrotationtimeunit: day

To rotate the log at 11:30 pm daily if the file size is greater than 10 KB, the nsslapd-accesslog-logrotationtime must be set as follows:

nsslapd-accesslog-logrotationtime: 1 2330 10

---

---

Example 3 To Rotate the Error Log at Any Time if the File Size is Greater Than 10 KB




To specify when the error log is rotated, the nsslapd-errorlog-logrotationtime and the nsslapd-errorlog-logrotationtimeunit attributes must be set.

To rotate the log every minute if the file size is greater the 10 KB, the nsslapd-errorlog-logrotationtimeunit attribute must be set as follows:

nsslapd-accesslog-logrotationtimeunit: Minute

To rotate the log when the file size is greater than 10 KB , the nsslapd-errorlog-logrotationtime must be set as follows:

nsslapd-errorlog-logrotationtime: 1 * 10

The time-of-day is specified as *, therefore, no specific time of day is specified.

---

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Unstable

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Synopsis | Description | Examples | Attributes

nsslapd-auditlog-logrotationtimeunit(5dsconf)

Name | Description | Attributes

Name

nsslapd-accesslog-logrotationtimeunit, nsslapd-auditlog-logrotationtimeunit, nsslapd-errorlog-logrotationtimeunit – Specify the unit for the time-interval part of the nsslapd-access|audit|errorlog-logrotationtime attribute

Description

PROPERTY	VALUE
Entry DN	cn=config
Valid Range	Month | Week | Day | Hour | Minute
Default Value	Day
Syntax	DirectoryString

Specifies the unit for the time-interval part of the nsslapd-access|audit|errorlog-logrotationtime attribute.

This attribute must be used in conjunction with the nsslapd-access|audit|errorlog-logrotationtime attribute.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Unstable

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Attributes

nsslapd-auditlog-maxlogsize(5dsconf)

Name | Description | Attributes

Name

nsslapd-accesslog-maxlogsize, nsslapd-auditlog-maxlogsize, nsslapd-errorlog-maxlogsize – Specify the maximum size of the access, audit, or error log in megabytes

Description

PROPERTY	VALUE
Entry DN	cn=config
Valid Range	-1 | 1 to the maximum 32–bit integer value (2147483647). A value of -1 means the log file is unlimited in size.
Default Value	100
Syntax	Integer

This attribute specifies the maximum size of the access, audit, or error log in megabytes. When this value is reached, the log is rotated.

If the nsslapd-accesslog-maxlogsperdir, nsslapd-auditlog-maxlogsperdir, or nsslapd-errorlog-maxlogsperdir attribute is set to 1, the server ignores the respective nsslapd-accesslog-maxlogsize, nsslapd-auditlog-maxlogsize, or nsslapd-errorlog-maxlogsize attribute.

When you set a maximum log size, consider the total number of log files that can be created due to log file rotation. Also, remember that there are three different log files (access log, audit log, and error log) maintained by Directory Server, each of which will consume disk space. Compare these considerations to the total amount of disk space that you want to be used by the log.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Unstable

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Attributes

nsslapd-auditlog-maxlogsperdir(5dsconf)

Name | Description | Attributes

Name

nsslapd-accesslog-maxlogsperdir, nsslapd-auditlog-maxlogsperdir, nsslapd-errorlog-maxlogsperdir – Specify the total number of access, audit, or error logs that can be contained in the access, audit, or error logs directory

Description

PROPERTY	VALUE
Entry DN	cn=config
Valid Range	1 to the maximum 32–bit integer value (2147483647)
Default Value	10
Syntax	Integer

This attribute specifies the total number of access, audit, or error logs that can be contained in the respective directory.

Each time the access log is rotated, a new log file is created. When the number of files contained in the access log directory exceeds the value stored on this attribute, the oldest version of the log file is deleted. The same scenario is true for audit logs and error logs.

If you set this value to 1, the server will not rotate the log and it will grow indefinitely.

If the value for this attribute is higher than 1, check the nsslapd-accesslog-logrotationtime,nsslapd-auditlog-logrotationtime, or nsslapd-errorlog-logrotationtime attribute to establish whether or not log rotation is specified.

If the nsslapd-accesslog-logrotationtime, nsslapd-auditlog-logrotationtime, or nsslapd-errorlog-logrotationtime attribute has a value of -1, there is no rotation of the respective log.

For more information, refer to the nsslapd-accesslog-logrotationtime, nsslapd-auditlog-logrotationtime, or nsslapd-errorlog-logrotationtime man page.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Unstable

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Attributes

nsslapd-auditlog-permissions(5dsconf)

Name | Synopsis | Description | Examples | Attributes

Name

nsslapd-accesslog-permissions, nsslapd-auditlog-permissions, nsslapd-errorlog-permissions – Specify the permissions for the log files

Synopsis

nsslapd-accesslog-permissions:  permissions

Description

PROPERTY	VALUE
Entry DN	cn=config
Valid Range	See description that follows.
Default Value	600
Syntax	UNIX style octal permissions.  Not supported on Windows platforms.

This attribute specifies the permissions for the log file.

Valid range is 001 to 777.

The permission 000 is not allowed because the server might have trouble starting for non-root users.

On Windows platforms, this attribute is ignored and a warning message is logged.

Examples

---

Example 1 To Set the Access Log Permssions to 644




nsslapd-accesslog-permissions:  644

---

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Unstable

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Synopsis | Description | Examples | Attributes

nsslapd-backend(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-backend – suffix used to process requests

Description

Gives the name of the suffix or chained suffix used to process requests. This attribute can be multivalued if you are using a custom distribution plug-in, with one suffix name per value. In this case, you must also specify the nsslapd-distribution-plugin and nsslapd-distribution-funct attributes.

---

Note –

Use Directory Proxy Server, rather than a Directory Server plug-in, for distribution.

---

This attribute is required when the value of the nsslapd-state attribute is set to backend, or to referral on update.

Entry DN

cn="suffixName",cn=mapping tree,cn=config

Valid Range

Any valid partition name.

Default Value

None

Syntax

DirectoryString

Example

nsslapd-backend: example

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 6, 2006

Name | Description | Attributes | See Also

nsslapd-berbufsize(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-berbufsize – initial BER buffer size

Description

This attribute defines the initial size in bytes of the buffer used to handle BER values.

In some cases where searches retrieving very large static groups, the default buffer size may cause slow performance due to the number of memory reallocation requests.

Entry DN

cn=config

Valid Range

0 - nsslapd-maxbersize, in bytes

A value of 0 indicates that the default value should be used.

Default Value

1024

Syntax

Integer

Example

nsslapd-berbufsize: 16384

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 5, 2006

Name | Description | Attributes | See Also

nsslapd-cachememsize(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-cachememsize – cache memory size

Description

Specifies the entry cache size in terms of the available memory space. Limiting cache size in terms of memory occupied is the simplest method. If you attempt to set a value that is not an integer or is too big for a 64-bit unsigned integer, or a 32-bit unsigned integer for 32-bit installations, you receive an LDAP_UNWILLING_TO_PERFORM error message with additional error information explaining the problem.

Entry DN

cn=dbName,cn=ldbm database,cn=plugins,cn=config

Valid Range

200 KB to 2⁶⁴-1 Bytes (200 KB to 2³²-1 Bytes for 32-bit installations)

Default Value

10 485 760 (10Mb)

Syntax

Integer

Example

nsslapd-cachememsize:10

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised April 12, 2007

Name | Description | Attributes | See Also

nsslapd-cachesize(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-cachesize – cache size

Description

Specifies the entry cache size in terms of the number of entries it can hold. Note that it is simpler to limit the cache by memory size only using the nsslapd-cachememsize attribute. If you attempt to set a value that is not an integer or is too big for a 64-bit unsigned integer, or a 32-bit unsigned integer for 32-bit installations, you receive an LDAP_UNWILLING_TO_PERFORM error message with additional error information explaining the problem.

Entry DN

cn=dbName,cn=ldbm database,cn=plugins,cn=config

Valid Range

1 to 2,147,483,647 (or -1 which means unlimited) entries

Default Value

-1

Syntax

Integer

Example

nsslapd-cachesize: -1

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 5, 2006

Name | Description | Attributes | See Also

nsslapd-certmap-basedn(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-certmap-basedn – certificate map search base

Description

This attribute can be used when client authentication is performed using SSL certificates in order to avoid limitation of the security subsystem certificate mapping, configured in certmap.conf.

Depending on the certmap.conf configuration, the certificate mapping may be done using a directory subtree search based at the root DN. Note that if the search is based at the root DN, then the nsslapd-certmap-basedn attribute may force the search to be based at some entry other than the root.

Entry DN

cn=config

Valid Range

The DN of an entry in the directory

Default Value

Not applicable

Syntax

DN

Example

nsslapd-certmap-basedn: ou=people,dc=example,dc=com

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 5, 2006

Name | Description | Attributes | See Also

nsslapd-changelogdir(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-changelogdir – changelog path

Description

This required attribute specifies the name of the directory in which the change log is created. Whenever a change log configuration entry is created it must contain a valid directory or the operation will be rejected.

---

Note –

For performance reasons, it is recommended that you store this database on a different physical disk from other databases.

If you change this value after enabling replication, the old changelog is deleted and a new changelog is created. Therefore, you should not change the value of this attribute after replication has been enabled and consumers initialized.

---

Entry DNs

cn=Retro Changelog Plugin,cn=plugins,cn=config

Valid Range

Any valid path to the directory storing the change log

Default Value

None

Syntax

DirectoryString

Example

nsslapd-changelogdir: /local/fastdisk/changelog

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 10, 2006

Name | Description | Attributes | See Also

nsslapd-changelogmaxage(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-changelogmaxage – maximum changelog age

Description

Specifies the maximum age of any entry in the change log. The change log contains a record for each directory modification and is used when synchronizing consumer servers. Each record contains a timestamp. Any record with a timestamp that is older than the value specified in this attribute will be removed. If this attribute is absent, there is no age limit on change log records.

Entry DNs

cn=Retro Changelog Plugin,cn=plugins,cn=config

Valid Range

0 (meaning that entries are not removed according to their age) to maximum integer (2147483647)

Default Value

0

Syntax

DirectoryString IntegerTimeunit

Here, Timeunit is s for seconds, m for minutes, h for hours, d for days, w for weeks.

Example

nsslapd-changelogmaxage: 30d

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 10, 2006

Name | Description | Attributes | See Also

nsslapd-changelogmaxentries(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-changelogmaxentries – maximum number of changelog records

Description

Specifies the maximum number of records the change log may contain. If this attribute is absent, there is no maximum number of records the change log can contain.

Entry DNs

cn=Retro Changelog Plugin,cn=plugins,cn=config

Valid Range

0 (no limit to the number of entries) to the maximum 32 bit integer value (2147483647).

Default Value

0

Syntax

Integer

Example

nsslapd-changelogmaxentries: 0

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 10, 2006

Name | Description | Attributes | See Also

nsslapd-config(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-config – DN of the server configuration

Description

This read-only attribute is the configuration DN.

Entry DN

cn=config

Valid Range

Any valid config DN.

Default Value

cn=config

Syntax

DirectoryString

Example

nsslapd-config: cn=config

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 5, 2006

Name | Description | Attributes | See Also

nsslapd-dbcachesize(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-dbcachesize – database cache size

Description

This performance tuning related attribute specifies database cache size. Note that this is neither the index cache nor the entry cache. If you activate automatic cache resizing, you override this attribute, by replacing these values with its own guessed values at a later stage of the server startup.

If you attempt to set a value that is not a number or is too big for a 32-bit or 64-bit signed integer, you receive an LDAP_UNWILLING_TO_PERFORM error message with additional error information explaining the problem.

---

Note –

The actual cache used may be significantly higher than what is specified in the nsslapd-cachememsize and nsslapd-dbcachesize attributes. It is therefore recommended that you do not specify a total cache size of more than 2 GB for 32-bit servers.

---

Changes to database cache size take effect after the server has been restarted.

Entry DN

cn=config,cn=ldbm database,cn=plugins,cn=config

Valid Range

500 KB to 4 GB for 32-bit platforms and 500 KB to 2^64-1 for 64-bit platforms

Default Value

32 MB

Syntax

Integer

Example

nsslapd-dbcachesize: 100 MB

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 6, 2006

Name | Description | Attributes | See Also

nsslapd-db-checkpoint-interval(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-db-checkpoint-interval – database checkpoint interval

Description

The amount of time in seconds after which Directory Server sends a checkpoint record to the database transaction log. The database transaction log contains a sequential listing of all recent database operations and is used for database recovery only. A checkpoint record indicates which database operations have been physically written to the directory database. The checkpoint records are used to determine where in the database transaction log to begin recovery after a system failure. The nsslapd-db-checkpoint-interval attribute is absent from dse.ldif. To change the checkpoint interval, you add the attribute to dse.ldif. This attribute can be dynamically modified using ldapmodify.

This attribute is provided only for system modification and diagnostics. It should be changed only with the guidance of engineering staff and Professional Services. Inconsistent settings of this attribute and other configuration attributes may cause Directory Server to be unstable.

Entry DN

cn=config,cn=ldbm database,cn=plugins,cn=config

Valid Range

10 to 300 seconds

Default Value

60

Syntax

Integer

Example

nsslapd-db-checkpoint-interval: 120

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised March 1, 2010

Name | Description | Attributes | See Also

nsslapd-db-circular-logging(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-db-circular-logging – circulate through transaction logs

Description

Specifies circular logging for the transaction log files. If this attribute is switched off, old transaction log files are not removed, and are kept renamed as old log transaction files. Turning circular logging off can severely degrade server performance. It should therefore only be modified with the guidance of Professional Services.

Entry DN

cn=config,cn=ldbm database,cn=plugins,cn=config

Valid Range

on | off

Default Value

on

Syntax

DirectoryString

Example

nsslapd-db-circular-logging: on

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised March 1, 2010

Name | Description | Attributes | See Also

nsslapd-db-durable-transactions(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-db-durable-transactions – when to write transactions to disk

Description

Indicates whether database transaction log entries are immediately written to the disk. The database transaction log contains a sequential listing of all recent database operations and is used for database recovery only.

With durable transactions enabled, every directory change is physically recorded in the log file and is therefore able to be recovered in the event of a system failure. However, the durable transactions feature may also slow down the performance of Directory Server. With durable transactions disabled, all transactions are logically written to the database transaction log but may not be physically written to disk immediately. If there is a system failure before a directory change is physically written to disk, that change is not recoverable.

Entry DN

cn=config,cn=ldbm database,cn=plugins,cn=config

Valid Range

on | off

Default Value

on

Syntax

DirectoryString

Example

nsslapd-db-durable-transactions: on

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 6, 2006

Name | Description | Attributes | See Also

nsslapd-db-home-directory(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-db-home-directory – database file location

Description

Used to fix a situation where the operating system endlessly flushes pages. This flushing can be so excessive that performance of the entire system is severely degraded.

This situation will occur only for certain combinations of the database cache size, the size of physical memory, and kernel tuning attributes. In particular, this situation should not occur if the database cache size is less than 100 MB.

For example, if your Solaris host seems excessively slow and your database cache size is around 100 MB or more, then you can use the iostat utility to diagnose the problem. Use iostat to monitor the activity of the disk where the Directory Server database files are stored. If all of the following conditions are true, then you can use the nsslapd-db-home-directory attribute to specify a subdirectory of a tempfs type file system.

• The disk is heavily used, more than 1 MB per second of data transfer.

• Service time is long, more than 100 ms.

• There is mostly write activity.

---

Note –

The directory referenced by the nsslapd-db-home-directory attribute must be a subdirectory of a file system of type tempfs, such as /tmp.

If you have multiple Directory Server instances on the same machine, their nsslapd-db-home-directory attributes must be configured with different directories. Failure to do so will result in the databases for both directories becoming corrupted.

Finally, use of this attribute causes internal Directory Server database files to be moved to the directory referenced by the attribute. It is possible, but unlikely, that the server will no longer start after the files have been moved because not enough memory can be committed. This is a symptom of an overly large database cache size being configured for your server. If this happens, reduce the size of your database cache size to a value where the server will start again.

---

Entry DN

cn=config,cn=ldbm database,cn=plugins,cn=config

Valid Range

Any valid directory name in a tempfs file system, such as /tmp.

Default Value

Not applicable

Syntax

DirectoryString

Example

nsslapd-db-home-directory: /tmp/ds1-db

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 6, 2006

Name | Description | Attributes | See Also

nsslapd-db-idl-divisor(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-db-idl-divisor – number of blocks per database page

Description

Specifies the index block size in terms of the number of blocks per database page. The block size is calculated by dividing the database page size by the value of this attribute. A value of 1 makes the block size exactly equal to the page size. The default value of 0 sets the block size to the page size minus an estimated allowance for internal database overhead. Before modifying the value of this attribute export all databases to LDIF. Once the modification has been made, reload the databases from LDIF.

Entry DN

cn=config,cn=ldbm database,cn=plugins,cn=config

Valid Range

0 to 8

Default Value

0

Syntax

Integer

Example

nsslapd-db-idl-divisor: 2

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 6, 2006

Name | Description | Attributes | See Also

nsslapd-db-locks(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-db-locks – number of database locks used

Description

Specifies the number of locks that can be used by the database. Increase the value of this attribute if you observe the following error:

libdb: Lock table is out of available locks

The current number of locks being used, the number of locks configured, and the maximum number of locks reached during the life of the process can be checked using the attributes nsslapd-db-current-locks, nsslapd-db-configured-locks, and nsslapd-db-max-locks respectively, under the entry cn=database,cn=monitor,cn=ldbm dababase,cn=plugins,cn=config.

Entry DN

cn=config,cn=ldbm database,cn=plugins,cn=config

Valid Range

1 to maximum integer

Default Value

20000

Syntax

Integer

Example

nsslapd-db-locks: 20000

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 6, 2006

Name | Description | Attributes | See Also

nsslapd-db-logbuf-size(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-db-logbuf-size – database log buffer size

Description

Specifies the log information buffer size. Log information is stored in memory until the buffer fills up or the transaction commit forces the buffer to be written to disk. Larger buffer sizes can significantly increase throughput in the presence of highly concurrent applications, or transactions producing large amounts of data. The nsslapd-db-logbuf-size attribute is only valid if the nsslapd-db-durable-transaction attribute is set to on.

---

Note –

You must be prepared to export all databases to LDIF, remove existing databases, and import all databases from LDIF when modifying this attribute.

---

Entry DN

cn=config,cn=ldbm database,cn=plugins,cn=config

Valid Range

0, 32768 to 2097152 bytes (limited by the transaction log file size, which is 10 MB by default)

0 is equivalent to 32768 bytes

Default Value

524288 for new instances

Syntax

Integer

Example

nsslapd-db-logbuf-size: 524288

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 6, 2006

Name | Description | Attributes | See Also

nsslapd-db-logdirectory(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-db-logdirectory – database transaction log directory

Description

The path to the directory containing the database transaction log. The database transaction log contains a sequential listing of all recent database operations and is used for database recovery only. By default, the database transaction log is stored in the same directory as the directory entries themselves, instance-path/db.

For fault-tolerance and performance reasons, you can move this log file to another physical disk. The nsslapd-db-logdirectory attribute is absent from dse.ldif. To change the location of the database transaction log, add the attribute to dse.ldif.

---

Note –

You must be prepared to export all databases to LDIF, remove existing databases, and re-import all databases from LDIF when modifying this attribute.

---

Entry DN

cn=config,cn=ldbm database,cn=plugins,cn=config

Valid Range

Any valid path and directory name.

Default Value

Not applicable

Syntax

DirectoryString

Example

nsslapd-db-logdirectory: /logs/txnlog

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 6, 2006

Name | Description | Attributes | See Also

nsslapd-db-logfile-size(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-db-logfile-size – maximum size of single database log file

Description

Specifies the maximum size of a single file in the log in bytes. By default, or if the value is set to 0, a maximum size of 10 MB is used. The maximum size is an unsigned four byte value. The value of this attribute can have significant impact on performance, as it can be tuned to avoid extensive log switching in the event of heavy entries.

Entry DN

cn=config,cn=ldbm database,cn=plugins,cn=config

Valid Range

0 to unsigned four byte integer

Default Value

10 (MB)

Syntax

Integer

Example

nsslapd-db-logfile-size: 10

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 6, 2006

Name | Description | Attributes | See Also

nsslapd-dbncache(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-dbncache – split database cache

Description

This attribute allows you to split the ldbm cache into equally sized separate pieces of memory. It is possible to specify caches that are large enough so that they cannot be allocated contiguously on some architectures. For example, some releases of Solaris limit the amount of memory that may be allocated contiguously by a process. If nsslapd-dbncache is 0 or 1, the cache will be allocated contiguously in memory. If it is greater than 1, the cache will be broken up into ncache equally sized separate pieces of memory.

This attribute is provided only for system modification, and diagnostics. It should be changed only with the guidance of Professional Services. Inconsistent settings of this attribute and other configuration attributes may cause Directory Server to be unstable.

Entry DN

cn=config,cn=ldbm database,cn=plugins,cn=config

Valid Range

Positive integer or 0

Default Value

0

Syntax

Integer

Example

nsslapd-dbncache: 0

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 6, 2006

Name | Description | Attributes | See Also

nsslapd-db-page-size(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-db-page-size – size of database pages in bytes

Description

Specifies the size of the pages used to hold items in the database, in bytes. Valid page sizes are 512, 1024, 2048, 4096, 8192, 16384, 32768, and 65536 bytes. If the page size is not explicitly set, Directory Server defaults to a page size of 8192 bytes. Ideally, page size is set such that entries fit in database pages without wasting space. Whether it is possible to achieve an ideal database page size depends on your entries, and on whether they are subject to change in size.

---

Note –

You must be prepared to export all databases to LDIF, remove existing databases, and import all databases from LDIF when modifying this attribute.

---

For ZFS file systems, you may find performance is best when the file system block size is set to equal the database page size. For example, try setting both to 32K or 64K.

To change the value of nsslapd-db-page-size, perform the following steps.

1. Shut down the Directory Server instance using the dsadm command.

2. Back up the Directory Server databases to LDIF using the dsadm export command.

3. Change the value of the attribute in dse.ldif.

4. Restore the Directory Server databases from LDIF using the dsadm import command.

5. Restart the Directory Server instance using the dsadm command.

Changing this default value can have significant performance impact. If the page size is too small, it results in extensive page splitting and copying, whereas if the page size is too large, it can waste disk space.

You can find entries in the overflowed pages using the following command:

install-path/lib/64/ns-slapd dbtest -D instance-path -n database

The maximum size of an entry that can fit in a normal page is db-page-size/4 — 24 (24 is the per page binary tree internal structure).

For example, in a database of 40 million entries, if the database page size is 8K, and an entry size is greater than 2024 bytes then it results in an overflowed page. If all entries in the database are larger than 2024 bytes, the 40 million overflowed pages are obtained. A search operation has to perform increased number of database input and output operations, that is, the initial block of the overflowed page and the total number of continuation blocks in the overflowed page, which in turn affects the performance.

If there are no or very few overflow pages in your database, then do not change the page size. Increasing the page size may result in more lock contention and increased input and output operations. The impact depends on the file system and its page size. If possible, matching database page size to the file system page size is the best practice.

The following list describes the characteristics of this configuration attribute.

Entry DN

cn=config,cn=ldbm database,cn=plugins,cn=config

Valid Range

512 bytes to 64 KB

Default Value

8192 (bytes)

Syntax

Integer

Example

nsslapd-db-page-size: 8192

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised February 9, 2009

Name | Description | Attributes | See Also

nsslapd-db-transaction-batch-val(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-db-transaction-batch-val – number of database transactions to batch before commit

Description

Specifies how many transactions are batched before being committed. You can use this attribute to improve update performance when full transaction durability is not required. This attribute can be dynamically modified using ldapmodify.

If you do not define this attribute or set it to a value of 0, transaction batching will be turned off and it will be impossible to make remote modifications to this attribute via LDAP. However, setting this attribute to a value greater than 0 causes the server to delay committing transactions until the number of queued transactions is equal to the attribute value. A value greater than 0 also allows you to modify this attribute remotely via LDAP. A value of 1 for this attribute allows you to modify the attribute setting remotely via LDAP, but results in no batching behavior. A value of 1 at server startup is therefore useful for maintaining normal durability, while also allowing transaction batching to be turned on and off remotely when desired. Bear in mind that the value you choose for this attribute may require you to modify the nsslapd-db-logbuf-size attribute to ensure sufficient log buffer size for accommodating your batched transactions. In practice, values should be positive numbers. Values larger than 100 bring few benefits.

---

Note –

The nsslapd-db-transaction-batch-val attribute is only valid if the nsslapd-db-durable-transaction attribute is set to on.

---

Entry DN

cn=config,cn=ldbm database,cn=plugins,cn=config

Valid Range

-2147483647 to 2147483648

Default Value

0 (meaning turned off)

Syntax

Integer

Example

nsslapd-db-transaction-batch-val: 5

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised May 25, 2007

Name | Description | Attributes | See Also

nsslapd-db-tx-max(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-db-tx-max – maximum concurrent database transactions

Description

Specifies the maximum number of concurrent transactions that can be handled by the database. Increase the value of this attribute if you observe the following error.

Serious Error---Failed in dblayer_txn_begin, err=12 (Not enough space)

Entry DN

cn=config,cn=ldbm database,cn=plugins,cn=config

Valid Range

1 to maximum integer

Default Value

210

Syntax

Integer

Example

nsslapd-db-tx-max: 210

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 6, 2006

Name | Description | Attributes | See Also

nsslapd-directory(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-directory – absolute path to database instance

Description

Specifies the absolute path to the database instance. If the database instance is created manually, this attribute must be included. Once the database instance has been created, do not modify this path as any changes risk preventing the server from accessing data.

Entry DN

cn=dbName,cn=ldbm database,cn=plugins,cn=config

Valid Range

Any valid absolute path to the database instance.

Default Value

None

Syntax

DirectoryString

Example

nsslapd-directory: /local/dsInst/db

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 6, 2006

Name | Description | Attributes | See Also

nsslapd-disk-full-threshold(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-disk-full-threshold – full disk threshold to limit database updates

Description

When the minimum free space on the disk in MB. When the available free space on any one of the disks used by a database instance falls below the value specified by this attribute, no updates are permitted and the server returns an LDAP_UNWILLING_TO_PERFORM error. Updates are allowed again as soon as free space rises above the threshold.

Entry DN

cn=config,cn=ldbm database,cn=plugins,cn=config

Valid Range

0 to unsigned 4-byte integer

Default Value

10

Syntax

Integer

Example

nsslapd-disk-full-threshold: 10

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 6, 2006

Name | Description | Attributes | See Also

nsslapd-disk-low-threshold(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-disk-low-threshold – low disk threshold to limit database updates

Description

Specifies the “low” free space on the disk (in MB). When the available free space on any one of the disks used by a database instance falls below the value specified by this attribute, protocol updates on that instance are permitted only by Directory Manager.

Entry DN

cn=config,cn=ldbm database,cn=plugins,cn=config

Valid Range

0 to unsigned 4-byte integer

Default Value

100

Syntax

Integer

Example

nsslapd-disk-low-threshold: 100

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 6, 2006

Name | Description | Attributes | See Also

nsslapd-distribution-funct(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-distribution-funct – distribution plug-in function

Description

Specifies the name of your distribution function within the library named by nsslapd-distribution-plugin. This attribute is required along with nsslapd-distribution-plugin when you have specified more than one database in the nsslapd-backend attribute.

---

Note –

Use Directory Proxy Server, rather than a Directory Server plug-in, for distribution.

---

Entry DN

cn="suffixName",cn=mapping tree,cn=config

Valid Range

The name of the distribution function.

Default Value

None

Syntax

DirectoryString

Example

nsslapd-distribution-funct: alphaNumDistrib

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 6, 2006

Name | Description | Attributes | See Also

nsslapd-distribution-plugin(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-distribution-plugin – distribution plug-in library

Description

Specifies the full path and filename of the shared library for the custom distribution plug-in. This attribute is required along with nsslapd-distribution-funct when you have specified more than one suffix in the nsslapd-backend attribute.

---

Note –

Use Directory Proxy Server, rather than a Directory Server plug-in, for distribution.

---

Entry DN

cn="suffixName",cn=mapping tree,cn=config

Valid Range

The full path and filename of the plug-in library.

Default Value

None

Syntax

DirectoryString

Example

nsslapd-distribution-plugin: /custom/plugins/myDistrib.so

Once you have distributed entries, you cannot redistribute them. The following restrictions apply.

• You cannot change your distribution function once you have deployed entry distribution.

• You cannot use the ldapmodify command to change an entry if that would cause them to be distributed into a different database.

• You cannot replicate databases that are distributed over multiple databases.

  Violating these restrictions prevents Directory Server from correctly locating and returning entries.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 6, 2006

Name | Description | Attributes | See Also

nsslapd-dn-cachememsize(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-dn-cachememsize – DN cache memory size

Description

Specifies the DN cache size in terms of the available memory space.

Entry DN

cn=config

Valid Range

Integer >= 1048576 Bytes

Default Value

10 485 760 (10Mb)

Syntax

Integer

Multi-valued

No

Read-write access

RW

Restart needed

Yes

Example

nsslapd-dn-cachememsize:2097152 (2Mb)

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised April 12, 2007

Name | Description | Attributes | See Also

nsslapd-dn-cachesize(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-dn-cachesize – DN cache size

Description

Specifies the DN cache size in terms of the number of entries it can hold. The value that can be assigned to nsslapd-dn-cachesize has the following impact on its behavior.

• 0 — means disabled

• -1 — means not limited by number of DNs but limited by the size specified in nsslapd-dn-cachememsize

• >=1 — cache is limited to the size that you specify here

Entry DN

cn=config

Valid Range

Integer >= 1, 0, or -1

Default Value

-1

Syntax

Integer

Multi-valued

No

Read Write access

RW

Restart Needed

Yes

Example

nsslapd-dn-cachesize: -1

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised April 12, 2007

Name | Description | Attributes | See Also

nsslapd-ds4-compatible-schema(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-ds4-compatible-schema – allow 4.x style schema definitions

Description

Makes the schema in cn=schema compatible with 4.x versions of Directory Server.

---

Note –

When this attribute is set to on, Directory Server can read schema from 4.x configuration files, which use syntax for attribute types and object classes that differs from the standard syntax defined by RFC 2252. As a result, when this attribute is set to on, schema cannot be modified using administrative tools, but must instead be modified manually.

---

Entry DN

cn=config

Valid Range

on | off

Default Value

off

Syntax

DirectoryString

Example

nsslapd-ds4-compatible-schema: off

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 5, 2006

Name | Description | Attributes | See Also

nsslapd-enquote-sup-oc(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-enquote-sup-oc – enable superior object class enquoting

Description

Controls whether the quoting in the objectclasses attributes contained in the cn=schema entry conforms to the quoting specified by internet draft RFC 2252. By default, Directory Server does not place single quotes around the superior object class identified on the objectclasses attributes contained in cn=schema. RFC 2252 indicates that this value should not be quoted.

That is, Directory Server publishes objectclasses attributes in the cn=schema entry as follows:

objectclasses: ( 2.5.6.6
 NAME 'person'
 DESC 'Standard ObjectClass'
 SUP 'top'
 MUST ( objectclass $ sn $ cn )
 MAY ( aci $ description $ seealso $ telephonenumber $ userpassword ) )

However, RFC 2252 indicates that this attribute should be published as follows:

objectclasses: ( 2.5.6.6
 NAME 'person'
 DESC 'Standard ObjectClass'
 SUP top
 MUST ( objectclass $ sn $ cn )
 MAY ( aci $ description $ seealso $ telephonenumber $ userpassword ) )

Notice the absence of single quotes around the word top.

Turning this attribute on means that some LDAP clients will no longer function, as they require the schema as defined in RFC 2252.

Turning this attribute off causes Directory Server to conform to RFC 2252, but doing so may interfere with some earlier LDAP clients.

Entry DN

cn=config

Valid Range

on | off

Default Value

off

Syntax

DirectoryString

Example

nsslapd-enquote-sup-oc: off

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 5, 2006

Name | Description | Attributes | See Also

nsslapd-errorlog(5dsconf)

Name | Description | Examples | Attributes

Name

nsslapd-accesslog, nsslapd-auditlog, nsslapd-errorlog – Specify the path and filename of the access|audit|error log

Description

PROPERTY	VALUE
Entry DN	cn=config
Valid Range	Any valid file name
Default Value	See description that follows.
Syntax	DirectoryString

These attributes specify the path and filename of the log used to record each database access. Default values are:

install-path/logs/access

install-path/logs/audit

install-path/logs/errors

The following information is recorded in the access log file by default:

• IP address of the client machine that accessed the database

• Operations performed such as search, add, modify

• Result of the access such as the number of entries returned for a search

The information recorded in the error log depends on the error log level but typically contains at least the server startup and shutdown times, and the server port number.

For logging to be enabled, both of the following conditions must be met:

• The nsslapd-*log attribute must be set to a valid file name.

• The nsslapd-*log-logging-enabled attribute must be set to on.

Other configurations result in logging being disabled.

Examples

nsslapd-accesslog: /local/dsInst/logs/access
nsslapd-auditlog: /local/dsInst/logs/audit
nsslapd-errorlog: /local/dsInst/logs/errors

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Stable

ODSEE 11.1.1.3.0  Last Revised March 1, 2010

Name | Description | Examples | Attributes

nsslapd-errorlog-level(5dsconf)

Name | Description | Examples | Attributes

Name

nsslapd-accesslog-level, nsslapd-auditlog-level, nsslapd-errorlog-level – Control what is logged to the access, audit, or error log

Description

PROPERTY	VALUE
Entry DN	cn=config
Valid Range	See the description that follows.
Default Value	256
Syntax	Integer

This attribute specifies the access log levels. Log levels can be added together to provide you with the exact type of logging you require. For example, 516 (4 + 512) obtains the internal access operation, entry access, and referral logging. The following levels are supported:

0

No access logging

4

Logging for internal access operations

256

Logging for access to an entry

512

Logging for access to an entry and referrals

131072

Precise timing of operation duration. This gives microsecond resolution for the elapsed time item in the access log.

Examples

nsslapd-accesslog-level: 256

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Unstable

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Examples | Attributes

nsslapd-errorlog-list(5dsconf)

Name | Description | Examples | Attributes

Name

nsslapd-accesslog-list, nsslapd-auditlog-list, nsslapd-errorlog-list – Provide a list of log files used in access, audit, or error log rotation.

Description

PROPERTY	VALUE
Entry DN	cn=config
Valid Range	Not applicable
Default Value	None
Syntax	DirectoryString

This attribute provides a list of log files used in access, audit, or error log rotation. This attribute is read only and cannot be set.

Examples

nsslapd-accesslog-list:accesslog2,accesslog3

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Unstable

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Examples | Attributes

nsslapd-errorlog-logbuffering(5dsconf)

Name | Description | Examples | Attributes

Name

nsslapd-accesslog-logbuffering, nsslapd-auditlog-logbuffering, nsslapd-errorlog-logbuffering – Determines whether the server writes access log entries directly to disk

Description

PROPERTY	VALUE
Entry DN	cn=config
Valid Range	on|off
Default Value	on
Syntax	DirectoryString

When this attribute is set to off, the server writes all access log entries directly to disk.

Examples

nsslapd-accesslog-logbuffering: off

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Unstable

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Examples | Attributes

nsslapd-errorlog-logexpirationtime(5dsconf)

Name | Description | Examples | Attributes

Name

nsslapd-accesslog-logexpirationtime, nsslapd-auditlog-logexpirationtime, nsslapd-errorlog-logexpirationtime – Specify the maximum age that an access, audit, or error log file is allowed to reach before it is deleted

Description

PROPERTY	VALUE
Entry DN	cn=config
Valid Range	1 to the maximum 32–bit integer value (2147483647)
Default Value	1
Syntax	Integer

Specifies the maximum age that an access, audit, or error log file is allowed to reach before it is deleted. This attribute supplies only the number of units. The units are provided by the nsslapd-accesslog-logexpirationtimeunit, nsslapd-auditlog-logexpirationtimeunit, or nsslapd-errorlog-logexpirationtimeunit attribute.

Examples

nsslapd-accesslog-logexpirationtime: 2

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Unstable

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Examples | Attributes

nsslapd-errorlog-logexpirationtimeunit(5dsconf)

Name | Description | Examples | Attributes

Name

nsslapd-accesslog-logexpirationtimeunit, nsslapd-auditlog-logexpirationtimeunit, nsslapd-errorlog-logexpirationtimeunit – Determines the unit of the log expiration time

Description

Property	Value
Entry DN	cn=config
Valid Range	month | week | day
Default Value	month
Syntax	DirectoryString

Specifies the unit for the nsslapd-accesslog-logexpirationtime, nsslapd-auditlog-logexpirationtime, or nsslapd-errorlog-logexpirationtime attribute. If the unit is unknown by the server, the log will never expire.

Examples

nsslapd-accesslog-logexpirationtimeunit: day

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Unstable

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Examples | Attributes

nsslapd-errorlog-logging-enabled(5dsconf)

Name | Description | Attributes

Name

nsslapd-accesslog-logging-enabled, nsslapd-auditlog-logging-enabled, nsslapd-errorlog-logging-enabled – Enable or disable access, audit, or error logging

Description

PROPERTY	VALUE
Entry DN	cn=config
Valid Range	on|off
Default Value	Access logging on, Audit logging off
Syntax	DirectoryString

This attribute is used in conjunction with the nsslapd-accesslog, nsslapd-auditlog, or nsslapd-errorlog attribute to disable and enable access, audit, or error logging. The nsslapd-accesslog, nsslapd-auditlog, or nsslapd-errorlog attributes specify the path and filename of the access, audit, and error logs, respectively.

For logging to be enabled, the nsslapd-accesslog-logging-enabled, nsslapd-auditlog-logging-enabled, or nsslapd-errorlog-logging-enabled attribute must be switched to on, and the respective nsslapd-accesslog, nsslapd-auditlog, or nsslapd-errorlog attribute must have a valid path and filename.

For information about the combinations of values for these attributes, see the nsslapd-accesslog, nsslapd-auditlog, or nsslapd-errorlog man page.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Unstable

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Attributes

nsslapd-errorlog-logmaxdiskspace(5dsconf)

Name | Description | Examples | Attributes

Name

nsslapd-accesslog-logmaxdiskspace, nsslapd-auditlog-logmaxdiskspace, nsslapd-errorlog-logmaxdiskspace – Specify the maximum amount of disk space in megabytes that the access, audit or error logs are allowed to consume

Description

PROPERTY	VALUE
Entry DN	cn=config
Valid Range	-1 | 1 to the maximum 32–bit integer value (2147483647). A value of -1 means that the disk space allowed for the log is unlimited in size.
Default Value	Access logs 500, audit logs and error logs 100
Syntax	Integer

Specifies the maximum amount of disk space in megabytes that the access, audit or error logs are allowed to consume. If this value is exceeded, the oldest access, audit or error log is deleted.

When setting the maximum disk space, consider the total number of log files that can be created due to log file rotation. As there are three different log files – access log, audit log, and error log – maintained by Directory Server, each of which consume disk space. Compare these considerations to the total amount of disk space that you want to be used by the each log.

Examples

nsslapd-accesslog-logmaxdiskspace: 200

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Unstable

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Examples | Attributes

nsslapd-errorlog-logminfreediskspace(5dsconf)

Name | Description | Examples | Attributes

Name

nsslapd-accesslog-logminfreediskspace, nsslapd-auditlog-logminfreediskspace, nsslapd-errorlog-logminfreediskspace – Specify the minimum amount of free disk space in megabytes that is allowed before an access, audit, or error log is deleted

Description

PROPERTY	VALUE
Entry DN	cn=config
Valid Range	1 to the maximum 32–bit integer value (2147483647)
Default Value	5
Syntax	Integer

Specifies the minimum amount of free disk space in megabytes that is allowed before an access, audit, or error log is deleted. When the amount of free disk space falls below the value specified by this attribute, the oldest access, audit, or error log is deleted until enough disk space is freed to satisfy this attribute.

Examples

nsslapd-accesslog-logminfreediskspace: 4

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Unstable

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Examples | Attributes

nsslapd-errorlog-logrotationtime(5dsconf)

Name | Synopsis | Description | Examples | Attributes

Name

nsslapd-accesslog-logrotationtime, nsslapd-auditlog-logrotationtime, nsslapd-errorlog-logrotationtime – Specify the time interval, the time of the day, and the minimum file size for rotation of the access log, audit log, or error log

Synopsis

nsslapd-accesslog-logrotationtime:
 {time-interval}  [time-of-day | *]  [min-file-size | *]

Description

PROPERTY	VALUE
Entry DN	cn=config
Valid Range	See description that follows.
Default Value	1 * *
Syntax	DirectoryString

This attribute specifies the time interval, the time of the day, and the minimum file size for access, audit, or error rotation. The unit of the time interval is specified by the nsslapd-accesslog-logrotationtimeunit, nsslapd-auditlog-logrotationtimeunit, or nsslapd-errorlog-logrotationtimeunit attribute.

The valid range for this attribute is as follows.

• time-interval

  Time interval at which the log is rotated. The unit of the time interval is given by the nsslapd-auditlog-logrotationtimeunit attribute.

• time-of-day

  Time of the day, on a 24-hour clock, at which the log is rotated.

  The value * means that no time of day is specified.

• min-file-size

  Minimum file size in kilobytes at which the log file is rotated. The log file is rotated if the file size is greater than the specified number of kilobytes.

  The value * means that no minimum file size is specified.

This attribute must be used in conjunction with the nsslapd-accesslog-logrotationtimeunit, nsslapd-auditlog-logrotationtimeunit, or nsslapd-errorlog-logrotationtimeunit attribute.

Examples

---

Example 1 To Rotate the Access Log at 11:30 pm Every Day Regardless of the Size of the Log File




To specify when the access log is rotated, the nsslapd-accesslog-logrotationtime and the nsslapd-accesslog-logrotationtimeunit attributes must be set.

To rotate the log daily, the nsslapd-accesslog-logrotationtimeunit must be set as follows:

nsslapd-accesslog-logrotationtimeunit: day

To rotate the log at 11:30 pm daily, the nsslapd-accesslog-logrotationtime must be set as follows:

nsslapd-accesslog-logrotationtime: 1 2330

The min-file-size is not specified, therefore,the log is rotated irrespective of the file size.

---

---

Example 2 To Rotate the Error Log at 11:30 pm Every Day if the File Size is Greater Than 10 KB




To specify when the error log is rotated, the nsslapd-errorlog-logrotationtime and the nsslapd-errorlog-logrotationtimeunit attributes must be set.

To rotate the log daily, the nsslapd-accesslog-logrotationtimeunit must be set as follows:

nsslapd-accesslog-logrotationtimeunit: day

To rotate the log at 11:30 pm daily if the file size is greater than 10 KB, the nsslapd-accesslog-logrotationtime must be set as follows:

nsslapd-accesslog-logrotationtime: 1 2330 10

---

---

Example 3 To Rotate the Error Log at Any Time if the File Size is Greater Than 10 KB




To specify when the error log is rotated, the nsslapd-errorlog-logrotationtime and the nsslapd-errorlog-logrotationtimeunit attributes must be set.

To rotate the log every minute if the file size is greater the 10 KB, the nsslapd-errorlog-logrotationtimeunit attribute must be set as follows:

nsslapd-accesslog-logrotationtimeunit: Minute

To rotate the log when the file size is greater than 10 KB , the nsslapd-errorlog-logrotationtime must be set as follows:

nsslapd-errorlog-logrotationtime: 1 * 10

The time-of-day is specified as *, therefore, no specific time of day is specified.

---

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Unstable

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Synopsis | Description | Examples | Attributes

nsslapd-errorlog-logrotationtimeunit(5dsconf)

Name | Description | Attributes

Name

nsslapd-accesslog-logrotationtimeunit, nsslapd-auditlog-logrotationtimeunit, nsslapd-errorlog-logrotationtimeunit – Specify the unit for the time-interval part of the nsslapd-access|audit|errorlog-logrotationtime attribute

Description

PROPERTY	VALUE
Entry DN	cn=config
Valid Range	Month | Week | Day | Hour | Minute
Default Value	Day
Syntax	DirectoryString

Specifies the unit for the time-interval part of the nsslapd-access|audit|errorlog-logrotationtime attribute.

This attribute must be used in conjunction with the nsslapd-access|audit|errorlog-logrotationtime attribute.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Unstable

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Attributes

nsslapd-errorlog-maxlogsize(5dsconf)

Name | Description | Attributes

Name

nsslapd-accesslog-maxlogsize, nsslapd-auditlog-maxlogsize, nsslapd-errorlog-maxlogsize – Specify the maximum size of the access, audit, or error log in megabytes

Description

PROPERTY	VALUE
Entry DN	cn=config
Valid Range	-1 | 1 to the maximum 32–bit integer value (2147483647). A value of -1 means the log file is unlimited in size.
Default Value	100
Syntax	Integer

This attribute specifies the maximum size of the access, audit, or error log in megabytes. When this value is reached, the log is rotated.

If the nsslapd-accesslog-maxlogsperdir, nsslapd-auditlog-maxlogsperdir, or nsslapd-errorlog-maxlogsperdir attribute is set to 1, the server ignores the respective nsslapd-accesslog-maxlogsize, nsslapd-auditlog-maxlogsize, or nsslapd-errorlog-maxlogsize attribute.

When you set a maximum log size, consider the total number of log files that can be created due to log file rotation. Also, remember that there are three different log files (access log, audit log, and error log) maintained by Directory Server, each of which will consume disk space. Compare these considerations to the total amount of disk space that you want to be used by the log.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Unstable

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Attributes

nsslapd-errorlog-maxlogsperdir(5dsconf)

Name | Description | Attributes

Name

nsslapd-accesslog-maxlogsperdir, nsslapd-auditlog-maxlogsperdir, nsslapd-errorlog-maxlogsperdir – Specify the total number of access, audit, or error logs that can be contained in the access, audit, or error logs directory

Description

PROPERTY	VALUE
Entry DN	cn=config
Valid Range	1 to the maximum 32–bit integer value (2147483647)
Default Value	10
Syntax	Integer

This attribute specifies the total number of access, audit, or error logs that can be contained in the respective directory.

Each time the access log is rotated, a new log file is created. When the number of files contained in the access log directory exceeds the value stored on this attribute, the oldest version of the log file is deleted. The same scenario is true for audit logs and error logs.

If you set this value to 1, the server will not rotate the log and it will grow indefinitely.

If the value for this attribute is higher than 1, check the nsslapd-accesslog-logrotationtime,nsslapd-auditlog-logrotationtime, or nsslapd-errorlog-logrotationtime attribute to establish whether or not log rotation is specified.

If the nsslapd-accesslog-logrotationtime, nsslapd-auditlog-logrotationtime, or nsslapd-errorlog-logrotationtime attribute has a value of -1, there is no rotation of the respective log.

For more information, refer to the nsslapd-accesslog-logrotationtime, nsslapd-auditlog-logrotationtime, or nsslapd-errorlog-logrotationtime man page.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Unstable

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Attributes

nsslapd-errorlog-permissions(5dsconf)

Name | Synopsis | Description | Examples | Attributes

Name

nsslapd-accesslog-permissions, nsslapd-auditlog-permissions, nsslapd-errorlog-permissions – Specify the permissions for the log files

Synopsis

nsslapd-accesslog-permissions:  permissions

Description

PROPERTY	VALUE
Entry DN	cn=config
Valid Range	See description that follows.
Default Value	600
Syntax	UNIX style octal permissions.  Not supported on Windows platforms.

This attribute specifies the permissions for the log file.

Valid range is 001 to 777.

The permission 000 is not allowed because the server might have trouble starting for non-root users.

On Windows platforms, this attribute is ignored and a warning message is logged.

Examples

---

Example 1 To Set the Access Log Permssions to 644




nsslapd-accesslog-permissions:  644

---

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Unstable

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Synopsis | Description | Examples | Attributes

nsslapd-exclude-from-export(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-exclude-from-export – attributes excluded during database export

Description

Specifies a list of attributes that are excluded when the database is exported.

Entry DN

cn=config,cn=ldbm database,cn=plugins,cn=config

Valid Range

N/A

Default Value

entrydn entryid dncomp parentid numSubordinates

Syntax

DirectoryString

Example

nsslapd-exclude-from-export: entrydn entryid

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 6, 2006

Name | Description | Attributes | See Also

nsslapd-groupevalnestlevel(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-groupevalnestlevel – level of access control nesting for group evaluations

Description

Specifies the number of levels of nesting that the access control system will perform for group evaluation.

Entry DN

cn=config

Valid Range

0 to the maximum 64-bit integer value

Default Value

0

Syntax

Integer

Example

nsslapd-groupevalnestlevel: 5

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 5, 2006

Name | Description | Attributes | See Also

nsslapd-groupevalsizelimit(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-groupevalsizelimit – maximum number of static group members for ACI evaluation.

Description

Defines the maximum number of members that a static group (including members of its sub-groups) can have for ACI evaluation.

Entry DN

cn=config

Valid Range

0 to the maximum 64-bit integer value

A value of -1 means infinite.

Default Value

5000

Syntax

Integer

Example

nsslapd-groupevalsizelimit: 5000

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised June 26, 2008

Name | Description | Attributes | See Also

nsslapd-idletimeout(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-idletimeout – idle timeout

Description

Specifies the amount of time in seconds after which an idle LDAP client connection is closed by the server. A value of 0 indicates that the server will never close idle connections.

Entry DN

cn=config

Valid Range

0 to the maximum 32-bit integer value (2147483647)

Default Value

0

Syntax

Integer

Example

nsslapd-IdleTimeout: 0

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 5, 2006

Name | Description | Attributes | See Also

nsslapd-import-cachesize(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-import-cachesize – database cache size for import

Description

This performance tuning related attribute determines the size of the database cache used in the bulk import process. By setting this attribute value so that the maximum available system physical memory is used for the database cache during bulk importing, you can optimize bulk import speed. If you attempt to set a value that is not a number or is too big for a 32-bit signed integer, you receive an LDAP_UNWILLING_TO_PERFORM error message with additional error information explaining the problem.

---

Note –

A cache is created for each load that occurs. For example, if the user sets the nsslapd-import-cachesize attribute to 1 GB, then 1 GB is used when loading one database, 2 GB is used when loading 2 databases, and so forth.

Ensure that you have sufficient physical memory to prevent swapping from occurring, as this results in performance degradation.

---

Entry DN

cn=config,cn=ldbm database,cn=plugins,cn=config

Valid Range

20 MB to 4 GB for 32-bit platforms and 20 MB to 2^64-1 for 64-bit platforms

Default Value

64 MB

Syntax

Integer

Example

nsslapd-import-cachesize: 209715200

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 6, 2006

Name | Description | Attributes | See Also

nsslapd-infolog-area(5dsconf)

Name | Description | Examples | Attributes

Name

nsslapd-infolog-area – Specify the component for which logging information should be provided.

Description

PROPERTY	VALUE
Entry DN	cn=config
Valid Range	See description that follows.
Default Value	0
Syntax	Integer

Specifies the component for which logging information should be provided. Each component is identified as an area, whose value is a decimal translation of the hex values in slapi-plugin.h. The valid range includes the following values:

0

Default logging area, used for critical errors and other messages that are always written to the error log, for example server startup messages. Messages at this level are always included in the error log regardless of the nsslapd-infolog-level setting.

1

Trace function calls. Logs a message when the server enters and exits a function.

4

Search arguments processing.

8

Connection management

16

Print out packets sent/received

32

Search filter processing

64

Config file processing

128

Access control list processing

512

LDBM processing.

2048

Log LDIF entry parsing debugging

4096

Housekeeping thread debugging

8192

Replication debugging

32768

Database cache debugging.

65536

Server plug-in debugging. An entry is written to the log file when a server plug-in calls slapi_log_info_ex().

The log area is additive. For example, to enable logging on search filter processing (32) and Config file processing (64), you would set this attribute to 96 (32+64).

Examples

nsslapd-infolog-area: 4096

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Unstable

ODSEE 11.1.1.3.0  Last Revised March 1, 2010

Name | Description | Examples | Attributes

nsslapd-infolog-level(5dsconf)

Name | Description | Examples | Attributes

Name

nsslapd-infolog-level – Specify the level of logging information that should be returned for the server component defined by the nsslapd-infolog-area attribute

Description

PROPERTY	VALUE
Entry DN	cn=config
Valid Range	0 | 1
Default Value	0
Syntax	Integer

Specifies the level of logging information that should be returned for the server component defined by the nsslapd-infolog-area attribute. A value of 0 means that only default logging information is returned for the selected area. Setting this attribute to 1 enables additional logging information to be returned for the selected area.

Examples

nsslapd-infolog-level: 1

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Unstable

ODSEE 11.1.1.3.0  Last Revised March 1, 2010

Name | Description | Examples | Attributes

nsslapd-instancedir(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-instancedir – instance path

Description

Specifies the full path to the directory where this server instance is installed, by default the instance-path given at installation time. Do not change this value after installation.

Entry DN

cn=config

Valid Range

Any valid file path.

Default Value

instance-path

Syntax

DirectoryString

Example

nsslapd-instancedir: /local/dsInst

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 5, 2006

Name | Description | Attributes | See Also

nsslapd-ioblocktimeout(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-ioblocktimeout – IO block time out

Description

Specifies the amount of time in milliseconds after which the connection to a stalled LDAP client is closed. An LDAP client is considered to be stalled when it has not made any I/O progress for read or write operations.

Entry DN

cn=config

Valid Range

0 to the maximum 32-bit integer value (2147483647)

Default Value

30000

Syntax

Integer

Example

nsslapd-ioblocktimeout: 1800000

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 5, 2006

Name | Description | Attributes | See Also

nsslapd-lastmod(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-lastmod – track modification time

Description

Specifies whether Directory Server maintains the modification attributes for Directory Server entries. These attributes include the following.

• modifiersname, which is the distinguished name of the person who last modified the entry.

• modifytimestamp, which is the timestamp, in GMT format, for when the entry was last modified.

• creatorsname, which is the distinguished name of the person who initially created the entry.

• createtimestamp, which is the timestamp for when the entry was created in GMT format.

Entry DN

cn=config

Valid Range

on | off

Default Value

on

Syntax

DirectoryString

Example

nsslapd-lastmod: off

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 5, 2006

Name | Description | Attributes | See Also

nsslapd-listenBacklog(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-listenBacklog – maximum number of pending connections

Description

Allows you to configure the maximum number of pending connections on a socket used by Directory Server. This configuration value is passed as the backlog parameter to the listen() call on Solaris systems for example.

Entry DN

cn=config

Valid Range

0 to the maximum int for the system

Default Value

128

Syntax

Integer

Example

nsslapd-listenBacklog:1024

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 5, 2006

Name | Description | Attributes | See Also

nsslapd-listenhost(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-listenhost – listen to IP address

Description

Allows multiple Directory Server instances to run on a multi-homed machine, and makes it possible to limit listening to one or more interfaces of a multi-homed machine. Provide the host name or host names corresponding to the IP interface or interfaces you want to specify as values for this attribute. Directory Server responds only to requests sent to the interface or interfaces corresponding to the host name or host names specified. This prevents other programs from using the same port as Directory Server on the specified interfaces.

Entry DN

cn=config

Valid Range

Any host name or host names

Default Value

Not applicable

Syntax

DirectoryString

Example

nsslapd-listenhost: host_name

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 5, 2006

Name | Description | Attributes | See Also

nsslapd-localhost(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-localhost – local host system name

Description

This read-only attribute specifies the host system on which Directory Server runs.

Entry DN

cn=config

Valid Range

Any fully qualified hostname.

Default Value

Hostname of installed machine.

Syntax

DirectoryString

Example

nsslapd-localhost: myServer.example.com

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 5, 2006

Name | Description | Attributes | See Also

nsslapd-localuser(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-localuser – local user name

Description

Specifies the user under which Directory Server runs. The group under which the user runs is derived from this attribute, by examining the groups that the user is a member of. Should the user change, all the files in the installation directory must be owned by this user.

Entry DN

cn=config

Valid Range

Any valid user on the local system.

Default Value

To run as the same user who started Directory Server.

Syntax

DirectoryString

Example

nsslapd-localuser: nobody

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 5, 2006

Name | Description | Attributes | See Also

nsslapd-maxbersize(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-maxbersize – maximum message size

Description

Defines the maximum size in bytes allowed for an incoming message. This limits the size of LDAP requests that can be handled by Directory Server. Limiting the size of requests prevents some kinds of denial of service attacks.

The limit applies to the total size of the LDAP request. For example, if the request is to add an entry, and the entry in the request is larger than two megabytes, then the add request is denied. Care should be taken when changing this attribute.

Entry DN

cn=config

Valid Range

0 - 2 GB (2,147,483,647 bytes), where a value of 0 indicates that the default value should be used.

Default Value

2097152

Syntax

Integer

Example

nsslapd-maxbersize: 2097152

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 5, 2006

Name | Description | Attributes | See Also

nsslapd-maxconnections(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-maxconnections – maximum number of connections

Description

This attribute limits the number of simultaneous connections the server can manage. The value of this attribute is not set by default. If it is not set manually, its implicit value is the maximum number of file descriptors a process can open on the system.

You can use this attribute to limit the amount of memory used by Directory Server. Directory Server allocates n*512 bytes of data, where n is equal to the value of nsslapd-maxconnections, if set, or to the maximum number of file descriptors a process can open on the system.

For example, on Solaris 9 systems, the maximum number of file descriptors is 64000. If nsslapd-maxconnections is not set, Directory Server allocates 35 MB of data, which may cause problems for some deployments. Setting nsslapd-maxconnections to a suitable value can help to alleviate this problem.

Entry DN

cn=config

Valid Range

nsslapd-reservedescriptors +1 to maxdescriptors.

If the maxdescriptors attribute is not set, the maximum value of nsslapd-maxconnections is the maximum number of file descriptors a process can open on the system.

Default Value

N/A

Syntax

Integer

Example

nsslapd-maxconnections: 4096

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 5, 2006

Name | Description | Attributes | See Also

nsslapd-maxdescriptors(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-maxdescriptors – maximum file descriptors

Description

This attribute sets the maximum, platform-dependent number of file descriptors that Directory Server will try to use. A file descriptor is used whenever a client connects to the server. It is also used for some server activities such as index maintenance. The number of available file descriptors for TCP/IP connections is the total for the nsslapd-maxdescriptors attribute minus the number of file descriptors used by the server for non-client connections, such as index management and managing replication, as specified in the nsslapd-reservedescriptors attribute.

The number that you specify here should not be greater than the total number of file descriptors that your operating system allows the ns-slapd process to use. This number will differ depending on your operating system. Some operating systems allow you to configure the number of file descriptors available to a process. Refer to your operating system documentation for details on file descriptor limits and configuration. It is worth noting that the included idsktune program can be used to suggest changes to the system kernel or TCP/IP tuning attributes, including increasing the number of file descriptors if necessary. You should consider increasing the value on this attribute if Directory Server is refusing connections because it is out of file descriptors. When this occurs, the following message is written to the Directory Server errors log file:

Not listening for new connections -- too many fds open

---

Note –

UNIX shells usually have configurable limits on the number of file descriptors. Refer to your operating system documentation for further information regarding limit and ulimit as these limits can often cause problems.

This parameter is not applicable on Windows.

---

Entry DN

cn=config

Valid Range

1 to 65535

Default Value

Maximum number of file descriptors allowed for a process

Syntax

Integer

Example

nsslapd-maxdescriptors: 8192

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised April 23, 2007

Name | Description | Attributes | See Also

nsslapd-maxpsearch(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-maxpsearch – maximum number of persistent searches

Description

Defines the maximum number of persistent searches that can be performed on Directory Server. The persistent search mechanism provides an active channel through which entries that change, and information about the changes that occur, can be communicated. Because each persistent search operation uses one thread, limiting the number of simultaneous persistent searches prevents certain kinds of denial of service attacks.

Entry DN

cn=config

Valid Range

1 to maximum thread number

Default Value

30

Syntax

Integer

Example

nsslapd-maxpsearch: 30

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 5, 2006

Name | Description | Attributes | See Also

nsslapd-maxthreadsperconn(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-maxthreadsperconn – maximum threads per connection

Description

Defines the maximum number of threads that a connection should use. For normal operations where a client binds and performs only one or two operations before unbinding, you should use the default value. For situations where a client binds and simultaneously issues many requests, you should increase this value to allow each connection enough resources to perform all the operations.

Entry DN

cn=config

Valid Range

1 to maximum thread number

Default Value

5

Syntax

Integer

Example

nsslapd-maxthreadsperconn: 5

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 5, 2006

Name | Description | Attributes | See Also

nsslapd-mode(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-mode – database index file permissions

Description

Specifies the permissions used for newly created index files.

Entry DN

cn=config,cn=ldbm database,cn=plugins,cn=config

Valid Range

Any four-digit octal number. However, mode 0600 is recommended. This allows read and write access for the owner of the index files, which is the server user, and no access for other users.

Default Value

0600

Syntax

Integer

Example

nsslapd-mode: 0600

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 6, 2006

Name | Description | Attributes | See Also

nsslapd-nagle(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-nagle – delay sending responses

Description

When the value of this attribute is off, the TCP_NODELAY option is set so that LDAP responses, such as entries or result messages, are sent back to a client immediately. When the attribute is turned on, default TCP behavior applies. That is, the sending of data is delayed, in the hope that this will enable additional data to be grouped into one packet of the underlying network MTU size, which is typically 1500 bytes for Ethernet.

Entry DN

cn=config

Valid range

on | off

Default value

off

Syntax

DirectoryString

Example

nsslapd-nagle: off

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 5, 2006

Name | Description | Attributes | See Also

nsslapd-plugin(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-plugin, nsslapd-plugin-depends-on-named, nsslapd-plugin-depends-on-type, nsslapd-pluginDescription, nsslapd-pluginEnabled, nsslapd-pluginId, nsslapd-pluginInitfunc, nsslapd-pluginPath, nsslapd-pluginType, nsslapd-pluginVendor, nsslapd-pluginVersion – Directory Server plug-in legacy configuration

Description

The nsslapd-plugin attribute on cn=config is multi-valued, read-only attribute lists the syntaxes and matching rules loaded by the server. This manual page covers server plug-in configuration, rather than the nsslapd-plugin attribute.

This manual page provides an overview of legacy configuration information for server plug-ins. This manual page covers the individual plug-in configuration entry attributes. Also, this manual page covers the plug-ins provided with Directory Server, including configurable options, configurable arguments, default setting, dependencies, general performance related information, and further reading.

---

Note –

In most circumstances, you configure plug-in functionality using the dsconf(1M) command. See plugin(5dsconf) for a list of configurable properties.

---

ATTRIBUTES FOR PLUG-IN CONFIGURATION ENTRIES

The following list covers each plug-in configuration entry attribute.

nsslapd-plugin-depends-on-named

This is a multivalued attribute, used to ensure that plug-ins are called by the server in the correct order. It takes a value that corresponds to the cn value of a plug-in. The plug-in whose cn value matches one of the values below it is started by the server prior to this plug-in. If the plug-in does not exist, the server fails to start.

Entry DN

cn=pluginName,cn=plugins, cn=config

Valid Range

Plug-in name

Default Value

None

Syntax

DirectoryString

Example

nsslapd-plugin-depends-on-named: Class of Service

nsslapd-plugin-depends-on-type

This is a multivalued attribute, used to ensure that plug-ins are called by the server in the correct order. It takes a value that corresponds to the type of a plug-in, contained in the attribute nsslapd-pluginType, and requires that plug-ins of that type are started before the present plug-in.

Entry DN

cn=pluginName,cn=plugins, cn=config

Valid Range

Plug-in type

Default Value

None

Syntax

DirectoryString

Example

nsslapd-plugin-depends-on-type: database

nsslapd-pluginDescription

Provides a description of the plug-in.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any DirectoryString

Default Value

None

Syntax

DirectoryString

Example

nsslapd-pluginDescription: acl access check plug-in

nsslapd-pluginEnabled

Specifies whether or not the plug-in is enabled. This attribute can be changed over protocol, but will only take effect when the server is next restarted.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

on | off

Default Value

on

Syntax

DirectoryString

Example

nsslapd-pluginEnabled: on

nsslapd-pluginId

Specifies the plug-in ID.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any valid plug-in ID.

Default Value

None

Syntax

DirectoryString

Example

nsslapd-pluginId: chaining database

nsslapd-pluginInitfunc

Specifies the plug-in function to be initiated.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any valid plug-in function.

Default Value

None

Syntax

DirectoryString

Example

nsslapd-pluginInitfunc: NS7bitAttr_Init

nsslapd-pluginPath

Specifies the full path to the plug-in.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any valid path

Default Value

None

Syntax

DirectoryString

Example

nsslapd-pluginPath: /opt/SUNWdsee7/lib/sparcv9/uid-plugin.so

nsslapd-pluginType

Specifies the plug-in type.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any valid plug-in type.

Default Value

None

Syntax

DirectoryString

Example

nsslapd-pluginType: preoperation

nsslapd-pluginVendor

Specifies the vendor of the plug-in.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any approved plug-in vendor.

Default Value

Sun Microsystems, Inc.

Syntax

DirectoryString

Example

nsslapd-pluginVendor: Sun Microsystems, Inc.

nsslapd-pluginVersion

Specifies the plug-in version.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any valid plug-in version.

Default Value

Product version

Syntax

DirectoryString

Example

nsslapd-pluginVersion: 11.1.1.3.0

7-BIT CHECK PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

7-Bit Check (NS7bitAttr)

DN of Configuration Entry

cn=7-bit check,cn=plugins,cn=config

Description

Checks certain attributes are seven-bit clean.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

List of attributes, uid mail userpassword, followed by a comma, and then by the suffix or suffixes on which the check is to occur.

Dependencies

None

Performance Related Information

None

Further Information

If your Directory Server uses non-ASCII characters such as Japanese and other languages for some attributes, remove those attributes from the list of attributes checked by this plug-in.

When adding or modifying an attribute value checked by this plug-in, and the new value violates the seven-bit check, the client receives a LDAP_CONSTRAINT_VIOLATION (19) return code, and a message such as the following: Value of attribute attr contains extended (8-bit) characters: value

ACL PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

ACL Plugin

DN of Configuration Entry

cn=ACL Plugin,cn=plugins,cn=config

Description

ACL access check plug-in

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Leave this plug-in running at all times.

ACL PREOPERATION PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

ACL preoperation

DN of Configuration Entry

cn=ACL preoperation,cn=plugins,cn=config

Description

ACL access check plug-in.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

Database

Performance Related Information

Leave this plug-in running at all times.

BINARY SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Binary Syntax

DN of Configuration Entry

cn=Binary Syntax,cn=plugins,cn=config

Description

Syntax for handling binary data.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

BOOLEAN SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Boolean Syntax

DN of Configuration Entry

cn=Boolean Syntax,cn=plugins,cn=config

Description

Syntax for handling booleans.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CASE EXACT STRING SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Case Exact String Syntax

DN of Configuration Entry

cn=Case Exact String Syntax,cn=plugins,cn=config

Description

Syntax for handling case-sensitive strings.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CASE IGNORE STRING SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Case Ignore String Syntax

DN of Configuration Entry

cn=Case Ignore String Syntax,cn=plugins,cn=config

Description

Syntax for handling case-insensitive strings.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CHAINING DATABASE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Chaining Database

DN of Configuration Entry

cn=Chaining database,cn=plugins,cn=config

Description

Syntax for handling DNs.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CLASS OF SERVICE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Class of Service

DN of Configuration Entry

cn=Class of Service,cn=plugins,cn=config

Description

Allows for sharing of attributes between entries.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

Set the nsslapd-pluginarg0 attribute to:

• 0 (default) to enable fast lookup of classic CoS templates

• 1 to disable fast lookup for classic CoS template selection

• 2 to disable checks for ambiguous pointer and classic CoS definitions

  Ambiguous definitions result when more than one value could be returned for the same attribute of the same entry. When checking remains enabled, Directory Server logs an informational message upon encountering such an ambiguity, provided you have set the log level to allow plug-ins to log informational messages.

• 3 to disable both

Restart Directory Server for modifications to take effect.

Dependencies

None

Performance Related Information

Leave this plug-in running at all times.

COUNTRY STRING SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Country String Syntax

DN of Configuration Entry

cn=Country String Syntax,cn=plugins,cn=config

Description

Syntax for handling countries.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

DISTINGUISHED NAME SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Distinguished Name Syntax

DN of Configuration Entry

cn=Distinguished Name Syntax,cn=plugins,cn=config

Description

Syntax for handling DNs.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

DSML FRONTEND SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Frontend

DN of Configuration Entry

cn=DSMLv2-SOAP-HTTP,cn=frontends,cn=plugins, cn=config

Description

Enables you to access the directory using DSML v2 over SOAP/HTTP.

Configurable Options

on | off

Default Setting

off

Configurable Arguments

ds-hdsml-soapschemalocation

ds-hdsml-dsmlschemalocation

Dependencies

None

Performance Related Information

None

GENERALIZED TIME SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Generalized Time Syntax

DN of Configuration Entry

cn=Generalized Time Syntax,cn=plugins,cn=config

Description

Syntax for dealing with dates, times, and time zones.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

Further Information

The Generalized Time String consists of the four digit year, two digit month (for example, 01 for January), two digit day, two digit hour, two digit minute, two digit second, an optional decimal part of a second and a time zone indication. We strongly recommend that you use the Z time zone indication (Greenwich Mean Time).

INTEGER SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Integer Syntax

DN of Configuration Entry

cn=Integer Syntax,cn=plugins,cn=config

Description

Syntax for handling integers.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

INTERNATIONALIZATION PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Internationalization Plugin

DN of Configuration Entry

cn=Internationalization Plugin,cn=plugins,cn=config

Description

Syntax for handling DNs.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None. In contrast to previous versions of Directory Server, the collation orders and locales used by the internationalization plug-in are now stored in the configuration.

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

LDBM DATABASE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

ldbm database plug-in

DN of Configuration Entry

cn=ldbm database plug-in,cn=plugins,cn=config

Description

Implements local databases.

Configurable Options

None

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Leave this plug-in running at all times.

MULTIMASTER REPLICATION PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Multimaster Replication Plugin

DN of Configuration Entry

cn=Multimaster Replication plugin,cn=plugins, cn=config

Description

Enables replication between two Directory Server suffixes.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

database

Performance Related Information

None

Further Information

You can turn this plug-in off if you have only one server, which will never replicate.

OCTET STRING SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Octet String Syntax

DN of Configuration Entry

cn=Octet String Syntax,cn=plugins,cn=config

Description

Syntax for handling octet strings.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CLEAR PASSWORD STORAGE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

CLEAR

DN of Configuration Entry

cn=CLEAR,cn=Password Storage Schemes,cn=plugins, cn=config

Description

CLEAR password storage scheme used for password encryption.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CRYPT PASSWORD STORAGE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

CRYPT

DN of Configuration Entry

cn=CRYPT,cn=Password Storage Schemes,cn=plugins, cn=config

Description

CRYPT password storage scheme used for password encryption.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

NS-MTA-MD5 PASSWORD STORAGE SCHEME PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

NS-MTA-MD5

DN of Configuration Entry

cn=NS-MTA-MD5,cn=Password Storage Schemes, cn=plugins,cn=config

Description

NS-MTA-MD5 password storage scheme for password encryption.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

Further Information

You can no longer choose to encrypt passwords using the NS-MTA-MD5 password storage scheme. The storage scheme is still present, but for backward compatibility only. The data in your directory still contains passwords encrypted with the NS-MTA-MD5 password storage scheme.

RMCE PASSWORD STORAGE SCHEME PLUG-IN

This password storage scheme plug-in is used for example by the administration framework and is reserved for internal use.

SHA PASSWORD STORAGE SCHEME PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

SHA

DN of Configuration Entry

cn=SHA,cn=Password Storage Schemes,cn=plugins, cn=config

Description

SHA password storage scheme for password encryption.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

If there are no passwords encrypted using the SHA password storage scheme, you may turn this plug-in off. If you want to encrypt your password with the SHA password storage scheme, choose SSHA instead. SSHA is a far more secure option.

SSHA PASSWORD STORAGE SCHEME PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

SSHA

DN of Configuration Entry

cn=SSHA,cn=Password Storage Schemes,cn=plugins, cn=config

Description

SSHA password storage scheme for password encryption.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

STRONG PASSWORD CHECK PLUG-IN

When Directory Server is configured to check password quality, and this plug-in is enabled, the plug-in checks the following each time a password is added or modified.

• Clear text password values contain the classes of characters specified by the configuration.

• Clear text password values do not contain any sequence of four characters present in the dictionary file specified by the configuration.

Hashed password values such as {SSHA}0Ri1g2yqlH3GTZcuRQ4uS22syCQLBKAU2ypLSw== are not checked.

Consider the following aspects of this plug-in.

Plug-In Name

Strong Password Checking plug-in

DN of Configuration Entry

cn=Strong Password Check,cn=plugins,cn=config

Configurable options and arguments

on | off

nsslapd-pluginarg0, which takes an integer representing a mask of values representing the character classes that must be present in a valid password. Set nsslapd-pluginarg0 to one of or a sum of the following values, not counting the special values 16 and 17.

• 1 means the password must contain special characters.

• 2 means the password must contain numeric characters.

• 4 means the password must contain upper case characters.

• 8 means the password must contain lower case characters.

• 16 is a special value meaning at least three of the four character classes.

• 17 is a special value meaning at least two of the four character classes.

The default setting is 15.

nsslapd-pluginarg1, which takes the absolute file system path to an ASCII dictionary file. If the argument is missing, the dictionary check is skipped. The plug-in does not initialize and Directory Server does not start if the value of this attribute is invalid or refers to an inaccessible file.

Default settings

off

Dependencies

Default password file, install-path/resources/plugins/words-english-big.txt

POSTAL ADDRESS STRING SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Postal Address Syntax

DN of Configuration Entry

cn=Postal Address Syntax,cn=plugins,cn=config

Description

Syntax used for handling postal addresses.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

PTA PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Pass Through Authentication

DN of Configuration Entry

cn=Pass Through Authentication,cn=plugins, cn=config

Description

Enables pass-through authentication, the mechanism that allows one directory to consult another to authenticate bind requests.

Configurable Options

on | off

Default Setting

off

Configurable Arguments

The LDAP URL to the configuration directory.

nsslapd-pluginarg0: ldap://config.example.com/o=example

Dependencies

None

REFERENTIAL INTEGRITY POSTOPERATION PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Referential Integrity Postoperation

DN of Configuration Entry

cn=Referential Integrity Postoperation, cn=plugins,cn=config

Description

Enables the server to ensure referential integrity.

All attributes in all databases that are used by the referential integrity plug-in must be indexed. The indexes need to be created in the configuration of all the databases. When the retro change log is enabled, the cn=changelog suffix must be indexed.

Configurable Options

All configuration and on | off

Default Setting

off

Configurable Arguments

When enabled, the post operation Referential Integrity plug-in performs integrity updates on the member, uniquemember, owner, and seeAlso attributes immediately after a delete or rename operation. You can reconfigure the plug-in to perform integrity checks on all other attributes.

The following arguments are configurable:

1. (nsslapd-pluginarg0) Check for referential integrity

   -1 = no check for referential integrity

   0 = check for referential integrity is performed immediately

   positive integer = request for referential integrity is queued and processed at a later stage. This positive integer serves as a wake-up call for the thread to process the request, at intervals corresponding to the integer specified.

2. (nsslapd-pluginarg1) Log file for storing the change, for example /local/dsInst/logs/referint

3. (nsslapd-pluginarg2) Reserved for future use.

4. (Other nsslapd-pluginarg* attributes) Attribute names to be checked for referential integrity.

Dependencies

database type

Tuning Recommendations

Do the following when you use the referential integrity plug-in in a multi-master replication environment:

• Enable the referential integrity plug-in on all servers containing master replicas

• Enable the referential integrity plug-in with the same configuration on every master

Set the first argument to a positive value, such as 10, meaning ten seconds, to ensure that work performed by this plug-in happens asynchronously, rather than synchronously.

When enabling the plug-in, also create equality indexes for all attributes configured for use with the plug-in. The plug-in uses such indexes when searching for entries to update. Without equality indexes for the attributes it uses, the plug-in must perform costly unindexed searches that have negative impact on performance.

RETRO CHANGE LOG PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Retro Changelog Plugin

DN of Configuration Entry

cn=Retro Changelog Plugin,cn=plugins,cn=config

Description

Used by LDAP clients for maintaining application compatibility with Directory Server 4.x versions.

Maintains a log of all changes occurring in Directory Server. The retro change log offers the same functionality as the changelog in the 4.x versions of Directory Server.

Configurable Options

on | off

Default Setting

off

Configurable Arguments

The following arguments can be configured for the retro change log plug-in:

• nsslapd-pluginarg0: -ignore_attributesconfigures the retro change log plug-in to ignore attributes specified by the following nsslapd-pluginarg. This argument is configured by default.

• nsslapd-pluginarg1: copyingFromspecifies a list of attributes to be ignored by the preceding nsslapd-pluginarg. This argument is configured by default.

• nsslapd-pluginarg2: suffixes="suffix1","suffix2" configures the retro change log to record updates to specified suffixes only

• nsslapd-pluginarg3: deletedEntryAttributes=attribute1,attribute2 configures the retro change log to record specified attributes of an entry when that entry is deleted

Dependencies

None

Performance Related Information

May slow down Directory Server performance.

Example Configuration

dn: cn=Retro Changelog Plugin,cn=plugins,cn=config
objectClass: top
objectClass: nsSlapdPlugin
objectClass: ds-signedPlugin
objectClass: extensibleObject
cn: Retro Changelog Plugin
nsslapd-pluginPath: /opt/SUNWdsee7/lib/sparcv9/retrocl-plugin.so
nsslapd-pluginInitfunc: retrocl_plugin_init
nsslapd-pluginType: object
nsslapd-plugin-depends-on-type: database
nsslapd-pluginarg0: -ignore_attributes
nsslapd-pluginarg1: copyingFrom
nsslapd-pluginarg2: suffixes="ou=people","dc=example","dc=com"
nsslapd-pluginarg3: deletedEntryAtrributes="objectclass","employeenumber"
nsslapd-changelogdir: /local/dsInst/db/changelog
nsslapd-pluginEnabled: on
nsslapd-pluginId: retrocl
nsslapd-pluginVersion: 11.1.1.3.0
nsslapd-pluginVendor: Sun Microsystems, Inc.
nsslapd-pluginDescription: Retrocl Plugin
ds-pluginSignatureState: valid signature

ROLES PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Roles Plugin

DN of Configuration Entry

cn=Roles Plugin,cn=plugins,cn=config

Description

Enables the use of roles in Directory Server.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

State Change Plugin

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

STATE CHANGE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

State Change Plugin

DN of Configuration Entry

cn=State Change Plugin,cn=plugins,cn=config

Description

State change notification service plug-in for detecting updates, such as configuration changes, and triggering callbacks when updates happen.

This plug-in is used internally by the roles plug-in.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

SUBTREE ENTRY COUNTER PLUG-INS

Consider the following aspects of this plug-in.

Plug-In Name

Subtree Entry Counter For ObjectClass

DN of Configuration Entry

cn=Subtree Entry Counter for ObjectClass,cn=plugins, cn=config

Description

Maintain a count of entries with a particular object class. The following plug-ins are provided.

• Subtree entry counter for departments in domains

• Subtree entry counter for domains within a domain

• Subtree entry counter for mail lists

• Subtree entry counter for nested departments

• Subtree entry counter for total domains

• Subtree entry counter for users

Configurable Options

on | off

Default Setting

off

Configurable Arguments

None

Dependencies

None

Performance Related Information

These plug-ins are provided for use with Messaging Server only, and are disabled by default. Leave these plug-ins disabled unless your Messaging Server requires them.

Counter Attributes Maintained

nsNumDepts

Either the number of departments within a domain, or the number of departments within a department (nested departments), depending on the DN of the entry.

nsNumDomains

Either the number of total domains, or the number of domains within a domain or nested domain, depending on the DN of the entry.

nsNumMailLists

Number of mail lists.

TELEPHONE SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Telephone Syntax

DN of Configuration Entry

cn=Telephone Syntax,cn=plugins,cn=config

Description

Syntax for handling telephone numbers.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

UID UNIQUENESS PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

UID Uniqueness

DN of Configuration Entry

cn=UID Uniqueness,cn=plugins,cn=config

Description

Checks that the values of specified attributes are unique each time a modification occurs on an entry.

Configurable Options

on | off

Default Setting

off

Configurable Arguments

You may configure this plug-in in either of two different ways.

1. Specify attributes that must be unique for a series of one or more subtrees identified by DNs. For example, to specify that employeeNumber and uid attribute values must be unique across both o=org1,dc=example,dc=com and o=org2,dc=example,dc=com , configure the arguments in the configuration entry as follows:

   nsslapd-pluginarg0: employeeNumber
   nsslapd-pluginarg1: uid
   nsslapd-pluginarg2: o=org1,dc=example,dc=com
   nsslapd-pluginarg3: o=org2,dc=example,dc=com

2. You specify attributes that must be unique inside congruent subtrees, optionally only on entries of a specified object class. For example, to specify that employeeNumber and uid attribute values must be unique in either o=org1,dc=example,dc=com or o=org2,dc=example,dc=com, but only on entries of the inetOrgPerson object class, configure the arguments in the configuration entry as follows:

   nsslapd-pluginarg0: employeeNumber
   nsslapd-pluginarg1: uid
   nsslapd-pluginarg2: MarkerObjectClass="organization"
    RequiredObjectClass="inetOrgPerson"

Dependencies

database type

Performance Related Information

Directory Server provides the UID Uniqueness plug-in by default. To ensure unique values for other attributes, you can create instances of the UID Uniqueness plug-in for those attributes.

The UID Uniqueness plug-in may slow down Directory Server performance.

URI PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

URI Syntax

DN of Configuration Entry

cn=URI Syntax,cn=plugins,cn=config

Description

Syntax for handling URIs (Unique Resource Identifiers) including URLs (Unique Resource Locators.)

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised June 2010

Name | Description | Attributes | See Also

nsslapd-plugin-depends-on-named(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-plugin, nsslapd-plugin-depends-on-named, nsslapd-plugin-depends-on-type, nsslapd-pluginDescription, nsslapd-pluginEnabled, nsslapd-pluginId, nsslapd-pluginInitfunc, nsslapd-pluginPath, nsslapd-pluginType, nsslapd-pluginVendor, nsslapd-pluginVersion – Directory Server plug-in legacy configuration

Description

The nsslapd-plugin attribute on cn=config is multi-valued, read-only attribute lists the syntaxes and matching rules loaded by the server. This manual page covers server plug-in configuration, rather than the nsslapd-plugin attribute.

This manual page provides an overview of legacy configuration information for server plug-ins. This manual page covers the individual plug-in configuration entry attributes. Also, this manual page covers the plug-ins provided with Directory Server, including configurable options, configurable arguments, default setting, dependencies, general performance related information, and further reading.

---

Note –

In most circumstances, you configure plug-in functionality using the dsconf(1M) command. See plugin(5dsconf) for a list of configurable properties.

---

ATTRIBUTES FOR PLUG-IN CONFIGURATION ENTRIES

The following list covers each plug-in configuration entry attribute.

nsslapd-plugin-depends-on-named

This is a multivalued attribute, used to ensure that plug-ins are called by the server in the correct order. It takes a value that corresponds to the cn value of a plug-in. The plug-in whose cn value matches one of the values below it is started by the server prior to this plug-in. If the plug-in does not exist, the server fails to start.

Entry DN

cn=pluginName,cn=plugins, cn=config

Valid Range

Plug-in name

Default Value

None

Syntax

DirectoryString

Example

nsslapd-plugin-depends-on-named: Class of Service

nsslapd-plugin-depends-on-type

This is a multivalued attribute, used to ensure that plug-ins are called by the server in the correct order. It takes a value that corresponds to the type of a plug-in, contained in the attribute nsslapd-pluginType, and requires that plug-ins of that type are started before the present plug-in.

Entry DN

cn=pluginName,cn=plugins, cn=config

Valid Range

Plug-in type

Default Value

None

Syntax

DirectoryString

Example

nsslapd-plugin-depends-on-type: database

nsslapd-pluginDescription

Provides a description of the plug-in.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any DirectoryString

Default Value

None

Syntax

DirectoryString

Example

nsslapd-pluginDescription: acl access check plug-in

nsslapd-pluginEnabled

Specifies whether or not the plug-in is enabled. This attribute can be changed over protocol, but will only take effect when the server is next restarted.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

on | off

Default Value

on

Syntax

DirectoryString

Example

nsslapd-pluginEnabled: on

nsslapd-pluginId

Specifies the plug-in ID.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any valid plug-in ID.

Default Value

None

Syntax

DirectoryString

Example

nsslapd-pluginId: chaining database

nsslapd-pluginInitfunc

Specifies the plug-in function to be initiated.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any valid plug-in function.

Default Value

None

Syntax

DirectoryString

Example

nsslapd-pluginInitfunc: NS7bitAttr_Init

nsslapd-pluginPath

Specifies the full path to the plug-in.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any valid path

Default Value

None

Syntax

DirectoryString

Example

nsslapd-pluginPath: /opt/SUNWdsee7/lib/sparcv9/uid-plugin.so

nsslapd-pluginType

Specifies the plug-in type.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any valid plug-in type.

Default Value

None

Syntax

DirectoryString

Example

nsslapd-pluginType: preoperation

nsslapd-pluginVendor

Specifies the vendor of the plug-in.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any approved plug-in vendor.

Default Value

Sun Microsystems, Inc.

Syntax

DirectoryString

Example

nsslapd-pluginVendor: Sun Microsystems, Inc.

nsslapd-pluginVersion

Specifies the plug-in version.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any valid plug-in version.

Default Value

Product version

Syntax

DirectoryString

Example

nsslapd-pluginVersion: 11.1.1.3.0

7-BIT CHECK PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

7-Bit Check (NS7bitAttr)

DN of Configuration Entry

cn=7-bit check,cn=plugins,cn=config

Description

Checks certain attributes are seven-bit clean.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

List of attributes, uid mail userpassword, followed by a comma, and then by the suffix or suffixes on which the check is to occur.

Dependencies

None

Performance Related Information

None

Further Information

If your Directory Server uses non-ASCII characters such as Japanese and other languages for some attributes, remove those attributes from the list of attributes checked by this plug-in.

When adding or modifying an attribute value checked by this plug-in, and the new value violates the seven-bit check, the client receives a LDAP_CONSTRAINT_VIOLATION (19) return code, and a message such as the following: Value of attribute attr contains extended (8-bit) characters: value

ACL PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

ACL Plugin

DN of Configuration Entry

cn=ACL Plugin,cn=plugins,cn=config

Description

ACL access check plug-in

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Leave this plug-in running at all times.

ACL PREOPERATION PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

ACL preoperation

DN of Configuration Entry

cn=ACL preoperation,cn=plugins,cn=config

Description

ACL access check plug-in.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

Database

Performance Related Information

Leave this plug-in running at all times.

BINARY SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Binary Syntax

DN of Configuration Entry

cn=Binary Syntax,cn=plugins,cn=config

Description

Syntax for handling binary data.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

BOOLEAN SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Boolean Syntax

DN of Configuration Entry

cn=Boolean Syntax,cn=plugins,cn=config

Description

Syntax for handling booleans.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CASE EXACT STRING SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Case Exact String Syntax

DN of Configuration Entry

cn=Case Exact String Syntax,cn=plugins,cn=config

Description

Syntax for handling case-sensitive strings.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CASE IGNORE STRING SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Case Ignore String Syntax

DN of Configuration Entry

cn=Case Ignore String Syntax,cn=plugins,cn=config

Description

Syntax for handling case-insensitive strings.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CHAINING DATABASE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Chaining Database

DN of Configuration Entry

cn=Chaining database,cn=plugins,cn=config

Description

Syntax for handling DNs.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CLASS OF SERVICE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Class of Service

DN of Configuration Entry

cn=Class of Service,cn=plugins,cn=config

Description

Allows for sharing of attributes between entries.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

Set the nsslapd-pluginarg0 attribute to:

• 0 (default) to enable fast lookup of classic CoS templates

• 1 to disable fast lookup for classic CoS template selection

• 2 to disable checks for ambiguous pointer and classic CoS definitions

  Ambiguous definitions result when more than one value could be returned for the same attribute of the same entry. When checking remains enabled, Directory Server logs an informational message upon encountering such an ambiguity, provided you have set the log level to allow plug-ins to log informational messages.

• 3 to disable both

Restart Directory Server for modifications to take effect.

Dependencies

None

Performance Related Information

Leave this plug-in running at all times.

COUNTRY STRING SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Country String Syntax

DN of Configuration Entry

cn=Country String Syntax,cn=plugins,cn=config

Description

Syntax for handling countries.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

DISTINGUISHED NAME SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Distinguished Name Syntax

DN of Configuration Entry

cn=Distinguished Name Syntax,cn=plugins,cn=config

Description

Syntax for handling DNs.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

DSML FRONTEND SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Frontend

DN of Configuration Entry

cn=DSMLv2-SOAP-HTTP,cn=frontends,cn=plugins, cn=config

Description

Enables you to access the directory using DSML v2 over SOAP/HTTP.

Configurable Options

on | off

Default Setting

off

Configurable Arguments

ds-hdsml-soapschemalocation

ds-hdsml-dsmlschemalocation

Dependencies

None

Performance Related Information

None

GENERALIZED TIME SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Generalized Time Syntax

DN of Configuration Entry

cn=Generalized Time Syntax,cn=plugins,cn=config

Description

Syntax for dealing with dates, times, and time zones.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

Further Information

The Generalized Time String consists of the four digit year, two digit month (for example, 01 for January), two digit day, two digit hour, two digit minute, two digit second, an optional decimal part of a second and a time zone indication. We strongly recommend that you use the Z time zone indication (Greenwich Mean Time).

INTEGER SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Integer Syntax

DN of Configuration Entry

cn=Integer Syntax,cn=plugins,cn=config

Description

Syntax for handling integers.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

INTERNATIONALIZATION PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Internationalization Plugin

DN of Configuration Entry

cn=Internationalization Plugin,cn=plugins,cn=config

Description

Syntax for handling DNs.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None. In contrast to previous versions of Directory Server, the collation orders and locales used by the internationalization plug-in are now stored in the configuration.

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

LDBM DATABASE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

ldbm database plug-in

DN of Configuration Entry

cn=ldbm database plug-in,cn=plugins,cn=config

Description

Implements local databases.

Configurable Options

None

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Leave this plug-in running at all times.

MULTIMASTER REPLICATION PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Multimaster Replication Plugin

DN of Configuration Entry

cn=Multimaster Replication plugin,cn=plugins, cn=config

Description

Enables replication between two Directory Server suffixes.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

database

Performance Related Information

None

Further Information

You can turn this plug-in off if you have only one server, which will never replicate.

OCTET STRING SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Octet String Syntax

DN of Configuration Entry

cn=Octet String Syntax,cn=plugins,cn=config

Description

Syntax for handling octet strings.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CLEAR PASSWORD STORAGE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

CLEAR

DN of Configuration Entry

cn=CLEAR,cn=Password Storage Schemes,cn=plugins, cn=config

Description

CLEAR password storage scheme used for password encryption.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CRYPT PASSWORD STORAGE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

CRYPT

DN of Configuration Entry

cn=CRYPT,cn=Password Storage Schemes,cn=plugins, cn=config

Description

CRYPT password storage scheme used for password encryption.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

NS-MTA-MD5 PASSWORD STORAGE SCHEME PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

NS-MTA-MD5

DN of Configuration Entry

cn=NS-MTA-MD5,cn=Password Storage Schemes, cn=plugins,cn=config

Description

NS-MTA-MD5 password storage scheme for password encryption.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

Further Information

You can no longer choose to encrypt passwords using the NS-MTA-MD5 password storage scheme. The storage scheme is still present, but for backward compatibility only. The data in your directory still contains passwords encrypted with the NS-MTA-MD5 password storage scheme.

RMCE PASSWORD STORAGE SCHEME PLUG-IN

This password storage scheme plug-in is used for example by the administration framework and is reserved for internal use.

SHA PASSWORD STORAGE SCHEME PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

SHA

DN of Configuration Entry

cn=SHA,cn=Password Storage Schemes,cn=plugins, cn=config

Description

SHA password storage scheme for password encryption.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

If there are no passwords encrypted using the SHA password storage scheme, you may turn this plug-in off. If you want to encrypt your password with the SHA password storage scheme, choose SSHA instead. SSHA is a far more secure option.

SSHA PASSWORD STORAGE SCHEME PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

SSHA

DN of Configuration Entry

cn=SSHA,cn=Password Storage Schemes,cn=plugins, cn=config

Description

SSHA password storage scheme for password encryption.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

STRONG PASSWORD CHECK PLUG-IN

When Directory Server is configured to check password quality, and this plug-in is enabled, the plug-in checks the following each time a password is added or modified.

• Clear text password values contain the classes of characters specified by the configuration.

• Clear text password values do not contain any sequence of four characters present in the dictionary file specified by the configuration.

Hashed password values such as {SSHA}0Ri1g2yqlH3GTZcuRQ4uS22syCQLBKAU2ypLSw== are not checked.

Consider the following aspects of this plug-in.

Plug-In Name

Strong Password Checking plug-in

DN of Configuration Entry

cn=Strong Password Check,cn=plugins,cn=config

Configurable options and arguments

on | off

nsslapd-pluginarg0, which takes an integer representing a mask of values representing the character classes that must be present in a valid password. Set nsslapd-pluginarg0 to one of or a sum of the following values, not counting the special values 16 and 17.

• 1 means the password must contain special characters.

• 2 means the password must contain numeric characters.

• 4 means the password must contain upper case characters.

• 8 means the password must contain lower case characters.

• 16 is a special value meaning at least three of the four character classes.

• 17 is a special value meaning at least two of the four character classes.

The default setting is 15.

nsslapd-pluginarg1, which takes the absolute file system path to an ASCII dictionary file. If the argument is missing, the dictionary check is skipped. The plug-in does not initialize and Directory Server does not start if the value of this attribute is invalid or refers to an inaccessible file.

Default settings

off

Dependencies

Default password file, install-path/resources/plugins/words-english-big.txt

POSTAL ADDRESS STRING SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Postal Address Syntax

DN of Configuration Entry

cn=Postal Address Syntax,cn=plugins,cn=config

Description

Syntax used for handling postal addresses.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

PTA PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Pass Through Authentication

DN of Configuration Entry

cn=Pass Through Authentication,cn=plugins, cn=config

Description

Enables pass-through authentication, the mechanism that allows one directory to consult another to authenticate bind requests.

Configurable Options

on | off

Default Setting

off

Configurable Arguments

The LDAP URL to the configuration directory.

nsslapd-pluginarg0: ldap://config.example.com/o=example

Dependencies

None

REFERENTIAL INTEGRITY POSTOPERATION PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Referential Integrity Postoperation

DN of Configuration Entry

cn=Referential Integrity Postoperation, cn=plugins,cn=config

Description

Enables the server to ensure referential integrity.

All attributes in all databases that are used by the referential integrity plug-in must be indexed. The indexes need to be created in the configuration of all the databases. When the retro change log is enabled, the cn=changelog suffix must be indexed.

Configurable Options

All configuration and on | off

Default Setting

off

Configurable Arguments

When enabled, the post operation Referential Integrity plug-in performs integrity updates on the member, uniquemember, owner, and seeAlso attributes immediately after a delete or rename operation. You can reconfigure the plug-in to perform integrity checks on all other attributes.

The following arguments are configurable:

1. (nsslapd-pluginarg0) Check for referential integrity

   -1 = no check for referential integrity

   0 = check for referential integrity is performed immediately

   positive integer = request for referential integrity is queued and processed at a later stage. This positive integer serves as a wake-up call for the thread to process the request, at intervals corresponding to the integer specified.

2. (nsslapd-pluginarg1) Log file for storing the change, for example /local/dsInst/logs/referint

3. (nsslapd-pluginarg2) Reserved for future use.

4. (Other nsslapd-pluginarg* attributes) Attribute names to be checked for referential integrity.

Dependencies

database type

Tuning Recommendations

Do the following when you use the referential integrity plug-in in a multi-master replication environment:

• Enable the referential integrity plug-in on all servers containing master replicas

• Enable the referential integrity plug-in with the same configuration on every master

Set the first argument to a positive value, such as 10, meaning ten seconds, to ensure that work performed by this plug-in happens asynchronously, rather than synchronously.

When enabling the plug-in, also create equality indexes for all attributes configured for use with the plug-in. The plug-in uses such indexes when searching for entries to update. Without equality indexes for the attributes it uses, the plug-in must perform costly unindexed searches that have negative impact on performance.

RETRO CHANGE LOG PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Retro Changelog Plugin

DN of Configuration Entry

cn=Retro Changelog Plugin,cn=plugins,cn=config

Description

Used by LDAP clients for maintaining application compatibility with Directory Server 4.x versions.

Maintains a log of all changes occurring in Directory Server. The retro change log offers the same functionality as the changelog in the 4.x versions of Directory Server.

Configurable Options

on | off

Default Setting

off

Configurable Arguments

The following arguments can be configured for the retro change log plug-in:

• nsslapd-pluginarg0: -ignore_attributesconfigures the retro change log plug-in to ignore attributes specified by the following nsslapd-pluginarg. This argument is configured by default.

• nsslapd-pluginarg1: copyingFromspecifies a list of attributes to be ignored by the preceding nsslapd-pluginarg. This argument is configured by default.

• nsslapd-pluginarg2: suffixes="suffix1","suffix2" configures the retro change log to record updates to specified suffixes only

• nsslapd-pluginarg3: deletedEntryAttributes=attribute1,attribute2 configures the retro change log to record specified attributes of an entry when that entry is deleted

Dependencies

None

Performance Related Information

May slow down Directory Server performance.

Example Configuration

dn: cn=Retro Changelog Plugin,cn=plugins,cn=config
objectClass: top
objectClass: nsSlapdPlugin
objectClass: ds-signedPlugin
objectClass: extensibleObject
cn: Retro Changelog Plugin
nsslapd-pluginPath: /opt/SUNWdsee7/lib/sparcv9/retrocl-plugin.so
nsslapd-pluginInitfunc: retrocl_plugin_init
nsslapd-pluginType: object
nsslapd-plugin-depends-on-type: database
nsslapd-pluginarg0: -ignore_attributes
nsslapd-pluginarg1: copyingFrom
nsslapd-pluginarg2: suffixes="ou=people","dc=example","dc=com"
nsslapd-pluginarg3: deletedEntryAtrributes="objectclass","employeenumber"
nsslapd-changelogdir: /local/dsInst/db/changelog
nsslapd-pluginEnabled: on
nsslapd-pluginId: retrocl
nsslapd-pluginVersion: 11.1.1.3.0
nsslapd-pluginVendor: Sun Microsystems, Inc.
nsslapd-pluginDescription: Retrocl Plugin
ds-pluginSignatureState: valid signature

ROLES PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Roles Plugin

DN of Configuration Entry

cn=Roles Plugin,cn=plugins,cn=config

Description

Enables the use of roles in Directory Server.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

State Change Plugin

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

STATE CHANGE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

State Change Plugin

DN of Configuration Entry

cn=State Change Plugin,cn=plugins,cn=config

Description

State change notification service plug-in for detecting updates, such as configuration changes, and triggering callbacks when updates happen.

This plug-in is used internally by the roles plug-in.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

SUBTREE ENTRY COUNTER PLUG-INS

Consider the following aspects of this plug-in.

Plug-In Name

Subtree Entry Counter For ObjectClass

DN of Configuration Entry

cn=Subtree Entry Counter for ObjectClass,cn=plugins, cn=config

Description

Maintain a count of entries with a particular object class. The following plug-ins are provided.

• Subtree entry counter for departments in domains

• Subtree entry counter for domains within a domain

• Subtree entry counter for mail lists

• Subtree entry counter for nested departments

• Subtree entry counter for total domains

• Subtree entry counter for users

Configurable Options

on | off

Default Setting

off

Configurable Arguments

None

Dependencies

None

Performance Related Information

These plug-ins are provided for use with Messaging Server only, and are disabled by default. Leave these plug-ins disabled unless your Messaging Server requires them.

Counter Attributes Maintained

nsNumDepts

Either the number of departments within a domain, or the number of departments within a department (nested departments), depending on the DN of the entry.

nsNumDomains

Either the number of total domains, or the number of domains within a domain or nested domain, depending on the DN of the entry.

nsNumMailLists

Number of mail lists.

TELEPHONE SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Telephone Syntax

DN of Configuration Entry

cn=Telephone Syntax,cn=plugins,cn=config

Description

Syntax for handling telephone numbers.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

UID UNIQUENESS PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

UID Uniqueness

DN of Configuration Entry

cn=UID Uniqueness,cn=plugins,cn=config

Description

Checks that the values of specified attributes are unique each time a modification occurs on an entry.

Configurable Options

on | off

Default Setting

off

Configurable Arguments

You may configure this plug-in in either of two different ways.

1. Specify attributes that must be unique for a series of one or more subtrees identified by DNs. For example, to specify that employeeNumber and uid attribute values must be unique across both o=org1,dc=example,dc=com and o=org2,dc=example,dc=com , configure the arguments in the configuration entry as follows:

   nsslapd-pluginarg0: employeeNumber
   nsslapd-pluginarg1: uid
   nsslapd-pluginarg2: o=org1,dc=example,dc=com
   nsslapd-pluginarg3: o=org2,dc=example,dc=com

2. You specify attributes that must be unique inside congruent subtrees, optionally only on entries of a specified object class. For example, to specify that employeeNumber and uid attribute values must be unique in either o=org1,dc=example,dc=com or o=org2,dc=example,dc=com, but only on entries of the inetOrgPerson object class, configure the arguments in the configuration entry as follows:

   nsslapd-pluginarg0: employeeNumber
   nsslapd-pluginarg1: uid
   nsslapd-pluginarg2: MarkerObjectClass="organization"
    RequiredObjectClass="inetOrgPerson"

Dependencies

database type

Performance Related Information

Directory Server provides the UID Uniqueness plug-in by default. To ensure unique values for other attributes, you can create instances of the UID Uniqueness plug-in for those attributes.

The UID Uniqueness plug-in may slow down Directory Server performance.

URI PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

URI Syntax

DN of Configuration Entry

cn=URI Syntax,cn=plugins,cn=config

Description

Syntax for handling URIs (Unique Resource Identifiers) including URLs (Unique Resource Locators.)

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised June 2010

Name | Description | Attributes | See Also

nsslapd-plugin-depends-on-type(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-plugin, nsslapd-plugin-depends-on-named, nsslapd-plugin-depends-on-type, nsslapd-pluginDescription, nsslapd-pluginEnabled, nsslapd-pluginId, nsslapd-pluginInitfunc, nsslapd-pluginPath, nsslapd-pluginType, nsslapd-pluginVendor, nsslapd-pluginVersion – Directory Server plug-in legacy configuration

Description

The nsslapd-plugin attribute on cn=config is multi-valued, read-only attribute lists the syntaxes and matching rules loaded by the server. This manual page covers server plug-in configuration, rather than the nsslapd-plugin attribute.

This manual page provides an overview of legacy configuration information for server plug-ins. This manual page covers the individual plug-in configuration entry attributes. Also, this manual page covers the plug-ins provided with Directory Server, including configurable options, configurable arguments, default setting, dependencies, general performance related information, and further reading.

---

Note –

In most circumstances, you configure plug-in functionality using the dsconf(1M) command. See plugin(5dsconf) for a list of configurable properties.

---

ATTRIBUTES FOR PLUG-IN CONFIGURATION ENTRIES

The following list covers each plug-in configuration entry attribute.

nsslapd-plugin-depends-on-named

This is a multivalued attribute, used to ensure that plug-ins are called by the server in the correct order. It takes a value that corresponds to the cn value of a plug-in. The plug-in whose cn value matches one of the values below it is started by the server prior to this plug-in. If the plug-in does not exist, the server fails to start.

Entry DN

cn=pluginName,cn=plugins, cn=config

Valid Range

Plug-in name

Default Value

None

Syntax

DirectoryString

Example

nsslapd-plugin-depends-on-named: Class of Service

nsslapd-plugin-depends-on-type

This is a multivalued attribute, used to ensure that plug-ins are called by the server in the correct order. It takes a value that corresponds to the type of a plug-in, contained in the attribute nsslapd-pluginType, and requires that plug-ins of that type are started before the present plug-in.

Entry DN

cn=pluginName,cn=plugins, cn=config

Valid Range

Plug-in type

Default Value

None

Syntax

DirectoryString

Example

nsslapd-plugin-depends-on-type: database

nsslapd-pluginDescription

Provides a description of the plug-in.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any DirectoryString

Default Value

None

Syntax

DirectoryString

Example

nsslapd-pluginDescription: acl access check plug-in

nsslapd-pluginEnabled

Specifies whether or not the plug-in is enabled. This attribute can be changed over protocol, but will only take effect when the server is next restarted.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

on | off

Default Value

on

Syntax

DirectoryString

Example

nsslapd-pluginEnabled: on

nsslapd-pluginId

Specifies the plug-in ID.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any valid plug-in ID.

Default Value

None

Syntax

DirectoryString

Example

nsslapd-pluginId: chaining database

nsslapd-pluginInitfunc

Specifies the plug-in function to be initiated.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any valid plug-in function.

Default Value

None

Syntax

DirectoryString

Example

nsslapd-pluginInitfunc: NS7bitAttr_Init

nsslapd-pluginPath

Specifies the full path to the plug-in.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any valid path

Default Value

None

Syntax

DirectoryString

Example

nsslapd-pluginPath: /opt/SUNWdsee7/lib/sparcv9/uid-plugin.so

nsslapd-pluginType

Specifies the plug-in type.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any valid plug-in type.

Default Value

None

Syntax

DirectoryString

Example

nsslapd-pluginType: preoperation

nsslapd-pluginVendor

Specifies the vendor of the plug-in.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any approved plug-in vendor.

Default Value

Sun Microsystems, Inc.

Syntax

DirectoryString

Example

nsslapd-pluginVendor: Sun Microsystems, Inc.

nsslapd-pluginVersion

Specifies the plug-in version.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any valid plug-in version.

Default Value

Product version

Syntax

DirectoryString

Example

nsslapd-pluginVersion: 11.1.1.3.0

7-BIT CHECK PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

7-Bit Check (NS7bitAttr)

DN of Configuration Entry

cn=7-bit check,cn=plugins,cn=config

Description

Checks certain attributes are seven-bit clean.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

List of attributes, uid mail userpassword, followed by a comma, and then by the suffix or suffixes on which the check is to occur.

Dependencies

None

Performance Related Information

None

Further Information

If your Directory Server uses non-ASCII characters such as Japanese and other languages for some attributes, remove those attributes from the list of attributes checked by this plug-in.

When adding or modifying an attribute value checked by this plug-in, and the new value violates the seven-bit check, the client receives a LDAP_CONSTRAINT_VIOLATION (19) return code, and a message such as the following: Value of attribute attr contains extended (8-bit) characters: value

ACL PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

ACL Plugin

DN of Configuration Entry

cn=ACL Plugin,cn=plugins,cn=config

Description

ACL access check plug-in

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Leave this plug-in running at all times.

ACL PREOPERATION PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

ACL preoperation

DN of Configuration Entry

cn=ACL preoperation,cn=plugins,cn=config

Description

ACL access check plug-in.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

Database

Performance Related Information

Leave this plug-in running at all times.

BINARY SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Binary Syntax

DN of Configuration Entry

cn=Binary Syntax,cn=plugins,cn=config

Description

Syntax for handling binary data.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

BOOLEAN SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Boolean Syntax

DN of Configuration Entry

cn=Boolean Syntax,cn=plugins,cn=config

Description

Syntax for handling booleans.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CASE EXACT STRING SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Case Exact String Syntax

DN of Configuration Entry

cn=Case Exact String Syntax,cn=plugins,cn=config

Description

Syntax for handling case-sensitive strings.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CASE IGNORE STRING SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Case Ignore String Syntax

DN of Configuration Entry

cn=Case Ignore String Syntax,cn=plugins,cn=config

Description

Syntax for handling case-insensitive strings.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CHAINING DATABASE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Chaining Database

DN of Configuration Entry

cn=Chaining database,cn=plugins,cn=config

Description

Syntax for handling DNs.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CLASS OF SERVICE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Class of Service

DN of Configuration Entry

cn=Class of Service,cn=plugins,cn=config

Description

Allows for sharing of attributes between entries.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

Set the nsslapd-pluginarg0 attribute to:

• 0 (default) to enable fast lookup of classic CoS templates

• 1 to disable fast lookup for classic CoS template selection

• 2 to disable checks for ambiguous pointer and classic CoS definitions

  Ambiguous definitions result when more than one value could be returned for the same attribute of the same entry. When checking remains enabled, Directory Server logs an informational message upon encountering such an ambiguity, provided you have set the log level to allow plug-ins to log informational messages.

• 3 to disable both

Restart Directory Server for modifications to take effect.

Dependencies

None

Performance Related Information

Leave this plug-in running at all times.

COUNTRY STRING SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Country String Syntax

DN of Configuration Entry

cn=Country String Syntax,cn=plugins,cn=config

Description

Syntax for handling countries.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

DISTINGUISHED NAME SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Distinguished Name Syntax

DN of Configuration Entry

cn=Distinguished Name Syntax,cn=plugins,cn=config

Description

Syntax for handling DNs.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

DSML FRONTEND SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Frontend

DN of Configuration Entry

cn=DSMLv2-SOAP-HTTP,cn=frontends,cn=plugins, cn=config

Description

Enables you to access the directory using DSML v2 over SOAP/HTTP.

Configurable Options

on | off

Default Setting

off

Configurable Arguments

ds-hdsml-soapschemalocation

ds-hdsml-dsmlschemalocation

Dependencies

None

Performance Related Information

None

GENERALIZED TIME SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Generalized Time Syntax

DN of Configuration Entry

cn=Generalized Time Syntax,cn=plugins,cn=config

Description

Syntax for dealing with dates, times, and time zones.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

Further Information

The Generalized Time String consists of the four digit year, two digit month (for example, 01 for January), two digit day, two digit hour, two digit minute, two digit second, an optional decimal part of a second and a time zone indication. We strongly recommend that you use the Z time zone indication (Greenwich Mean Time).

INTEGER SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Integer Syntax

DN of Configuration Entry

cn=Integer Syntax,cn=plugins,cn=config

Description

Syntax for handling integers.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

INTERNATIONALIZATION PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Internationalization Plugin

DN of Configuration Entry

cn=Internationalization Plugin,cn=plugins,cn=config

Description

Syntax for handling DNs.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None. In contrast to previous versions of Directory Server, the collation orders and locales used by the internationalization plug-in are now stored in the configuration.

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

LDBM DATABASE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

ldbm database plug-in

DN of Configuration Entry

cn=ldbm database plug-in,cn=plugins,cn=config

Description

Implements local databases.

Configurable Options

None

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Leave this plug-in running at all times.

MULTIMASTER REPLICATION PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Multimaster Replication Plugin

DN of Configuration Entry

cn=Multimaster Replication plugin,cn=plugins, cn=config

Description

Enables replication between two Directory Server suffixes.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

database

Performance Related Information

None

Further Information

You can turn this plug-in off if you have only one server, which will never replicate.

OCTET STRING SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Octet String Syntax

DN of Configuration Entry

cn=Octet String Syntax,cn=plugins,cn=config

Description

Syntax for handling octet strings.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CLEAR PASSWORD STORAGE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

CLEAR

DN of Configuration Entry

cn=CLEAR,cn=Password Storage Schemes,cn=plugins, cn=config

Description

CLEAR password storage scheme used for password encryption.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CRYPT PASSWORD STORAGE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

CRYPT

DN of Configuration Entry

cn=CRYPT,cn=Password Storage Schemes,cn=plugins, cn=config

Description

CRYPT password storage scheme used for password encryption.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

NS-MTA-MD5 PASSWORD STORAGE SCHEME PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

NS-MTA-MD5

DN of Configuration Entry

cn=NS-MTA-MD5,cn=Password Storage Schemes, cn=plugins,cn=config

Description

NS-MTA-MD5 password storage scheme for password encryption.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

Further Information

You can no longer choose to encrypt passwords using the NS-MTA-MD5 password storage scheme. The storage scheme is still present, but for backward compatibility only. The data in your directory still contains passwords encrypted with the NS-MTA-MD5 password storage scheme.

RMCE PASSWORD STORAGE SCHEME PLUG-IN

This password storage scheme plug-in is used for example by the administration framework and is reserved for internal use.

SHA PASSWORD STORAGE SCHEME PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

SHA

DN of Configuration Entry

cn=SHA,cn=Password Storage Schemes,cn=plugins, cn=config

Description

SHA password storage scheme for password encryption.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

If there are no passwords encrypted using the SHA password storage scheme, you may turn this plug-in off. If you want to encrypt your password with the SHA password storage scheme, choose SSHA instead. SSHA is a far more secure option.

SSHA PASSWORD STORAGE SCHEME PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

SSHA

DN of Configuration Entry

cn=SSHA,cn=Password Storage Schemes,cn=plugins, cn=config

Description

SSHA password storage scheme for password encryption.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

STRONG PASSWORD CHECK PLUG-IN

When Directory Server is configured to check password quality, and this plug-in is enabled, the plug-in checks the following each time a password is added or modified.

• Clear text password values contain the classes of characters specified by the configuration.

• Clear text password values do not contain any sequence of four characters present in the dictionary file specified by the configuration.

Hashed password values such as {SSHA}0Ri1g2yqlH3GTZcuRQ4uS22syCQLBKAU2ypLSw== are not checked.

Consider the following aspects of this plug-in.

Plug-In Name

Strong Password Checking plug-in

DN of Configuration Entry

cn=Strong Password Check,cn=plugins,cn=config

Configurable options and arguments

on | off

nsslapd-pluginarg0, which takes an integer representing a mask of values representing the character classes that must be present in a valid password. Set nsslapd-pluginarg0 to one of or a sum of the following values, not counting the special values 16 and 17.

• 1 means the password must contain special characters.

• 2 means the password must contain numeric characters.

• 4 means the password must contain upper case characters.

• 8 means the password must contain lower case characters.

• 16 is a special value meaning at least three of the four character classes.

• 17 is a special value meaning at least two of the four character classes.

The default setting is 15.

nsslapd-pluginarg1, which takes the absolute file system path to an ASCII dictionary file. If the argument is missing, the dictionary check is skipped. The plug-in does not initialize and Directory Server does not start if the value of this attribute is invalid or refers to an inaccessible file.

Default settings

off

Dependencies

Default password file, install-path/resources/plugins/words-english-big.txt

POSTAL ADDRESS STRING SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Postal Address Syntax

DN of Configuration Entry

cn=Postal Address Syntax,cn=plugins,cn=config

Description

Syntax used for handling postal addresses.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

PTA PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Pass Through Authentication

DN of Configuration Entry

cn=Pass Through Authentication,cn=plugins, cn=config

Description

Enables pass-through authentication, the mechanism that allows one directory to consult another to authenticate bind requests.

Configurable Options

on | off

Default Setting

off

Configurable Arguments

The LDAP URL to the configuration directory.

nsslapd-pluginarg0: ldap://config.example.com/o=example

Dependencies

None

REFERENTIAL INTEGRITY POSTOPERATION PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Referential Integrity Postoperation

DN of Configuration Entry

cn=Referential Integrity Postoperation, cn=plugins,cn=config

Description

Enables the server to ensure referential integrity.

All attributes in all databases that are used by the referential integrity plug-in must be indexed. The indexes need to be created in the configuration of all the databases. When the retro change log is enabled, the cn=changelog suffix must be indexed.

Configurable Options

All configuration and on | off

Default Setting

off

Configurable Arguments

When enabled, the post operation Referential Integrity plug-in performs integrity updates on the member, uniquemember, owner, and seeAlso attributes immediately after a delete or rename operation. You can reconfigure the plug-in to perform integrity checks on all other attributes.

The following arguments are configurable:

1. (nsslapd-pluginarg0) Check for referential integrity

   -1 = no check for referential integrity

   0 = check for referential integrity is performed immediately

   positive integer = request for referential integrity is queued and processed at a later stage. This positive integer serves as a wake-up call for the thread to process the request, at intervals corresponding to the integer specified.

2. (nsslapd-pluginarg1) Log file for storing the change, for example /local/dsInst/logs/referint

3. (nsslapd-pluginarg2) Reserved for future use.

4. (Other nsslapd-pluginarg* attributes) Attribute names to be checked for referential integrity.

Dependencies

database type

Tuning Recommendations

Do the following when you use the referential integrity plug-in in a multi-master replication environment:

• Enable the referential integrity plug-in on all servers containing master replicas

• Enable the referential integrity plug-in with the same configuration on every master

Set the first argument to a positive value, such as 10, meaning ten seconds, to ensure that work performed by this plug-in happens asynchronously, rather than synchronously.

When enabling the plug-in, also create equality indexes for all attributes configured for use with the plug-in. The plug-in uses such indexes when searching for entries to update. Without equality indexes for the attributes it uses, the plug-in must perform costly unindexed searches that have negative impact on performance.

RETRO CHANGE LOG PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Retro Changelog Plugin

DN of Configuration Entry

cn=Retro Changelog Plugin,cn=plugins,cn=config

Description

Used by LDAP clients for maintaining application compatibility with Directory Server 4.x versions.

Maintains a log of all changes occurring in Directory Server. The retro change log offers the same functionality as the changelog in the 4.x versions of Directory Server.

Configurable Options

on | off

Default Setting

off

Configurable Arguments

The following arguments can be configured for the retro change log plug-in:

• nsslapd-pluginarg0: -ignore_attributesconfigures the retro change log plug-in to ignore attributes specified by the following nsslapd-pluginarg. This argument is configured by default.

• nsslapd-pluginarg1: copyingFromspecifies a list of attributes to be ignored by the preceding nsslapd-pluginarg. This argument is configured by default.

• nsslapd-pluginarg2: suffixes="suffix1","suffix2" configures the retro change log to record updates to specified suffixes only

• nsslapd-pluginarg3: deletedEntryAttributes=attribute1,attribute2 configures the retro change log to record specified attributes of an entry when that entry is deleted

Dependencies

None

Performance Related Information

May slow down Directory Server performance.

Example Configuration

dn: cn=Retro Changelog Plugin,cn=plugins,cn=config
objectClass: top
objectClass: nsSlapdPlugin
objectClass: ds-signedPlugin
objectClass: extensibleObject
cn: Retro Changelog Plugin
nsslapd-pluginPath: /opt/SUNWdsee7/lib/sparcv9/retrocl-plugin.so
nsslapd-pluginInitfunc: retrocl_plugin_init
nsslapd-pluginType: object
nsslapd-plugin-depends-on-type: database
nsslapd-pluginarg0: -ignore_attributes
nsslapd-pluginarg1: copyingFrom
nsslapd-pluginarg2: suffixes="ou=people","dc=example","dc=com"
nsslapd-pluginarg3: deletedEntryAtrributes="objectclass","employeenumber"
nsslapd-changelogdir: /local/dsInst/db/changelog
nsslapd-pluginEnabled: on
nsslapd-pluginId: retrocl
nsslapd-pluginVersion: 11.1.1.3.0
nsslapd-pluginVendor: Sun Microsystems, Inc.
nsslapd-pluginDescription: Retrocl Plugin
ds-pluginSignatureState: valid signature

ROLES PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Roles Plugin

DN of Configuration Entry

cn=Roles Plugin,cn=plugins,cn=config

Description

Enables the use of roles in Directory Server.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

State Change Plugin

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

STATE CHANGE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

State Change Plugin

DN of Configuration Entry

cn=State Change Plugin,cn=plugins,cn=config

Description

State change notification service plug-in for detecting updates, such as configuration changes, and triggering callbacks when updates happen.

This plug-in is used internally by the roles plug-in.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

SUBTREE ENTRY COUNTER PLUG-INS

Consider the following aspects of this plug-in.

Plug-In Name

Subtree Entry Counter For ObjectClass

DN of Configuration Entry

cn=Subtree Entry Counter for ObjectClass,cn=plugins, cn=config

Description

Maintain a count of entries with a particular object class. The following plug-ins are provided.

• Subtree entry counter for departments in domains

• Subtree entry counter for domains within a domain

• Subtree entry counter for mail lists

• Subtree entry counter for nested departments

• Subtree entry counter for total domains

• Subtree entry counter for users

Configurable Options

on | off

Default Setting

off

Configurable Arguments

None

Dependencies

None

Performance Related Information

These plug-ins are provided for use with Messaging Server only, and are disabled by default. Leave these plug-ins disabled unless your Messaging Server requires them.

Counter Attributes Maintained

nsNumDepts

Either the number of departments within a domain, or the number of departments within a department (nested departments), depending on the DN of the entry.

nsNumDomains

Either the number of total domains, or the number of domains within a domain or nested domain, depending on the DN of the entry.

nsNumMailLists

Number of mail lists.

TELEPHONE SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Telephone Syntax

DN of Configuration Entry

cn=Telephone Syntax,cn=plugins,cn=config

Description

Syntax for handling telephone numbers.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

UID UNIQUENESS PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

UID Uniqueness

DN of Configuration Entry

cn=UID Uniqueness,cn=plugins,cn=config

Description

Checks that the values of specified attributes are unique each time a modification occurs on an entry.

Configurable Options

on | off

Default Setting

off

Configurable Arguments

You may configure this plug-in in either of two different ways.

1. Specify attributes that must be unique for a series of one or more subtrees identified by DNs. For example, to specify that employeeNumber and uid attribute values must be unique across both o=org1,dc=example,dc=com and o=org2,dc=example,dc=com , configure the arguments in the configuration entry as follows:

   nsslapd-pluginarg0: employeeNumber
   nsslapd-pluginarg1: uid
   nsslapd-pluginarg2: o=org1,dc=example,dc=com
   nsslapd-pluginarg3: o=org2,dc=example,dc=com

2. You specify attributes that must be unique inside congruent subtrees, optionally only on entries of a specified object class. For example, to specify that employeeNumber and uid attribute values must be unique in either o=org1,dc=example,dc=com or o=org2,dc=example,dc=com, but only on entries of the inetOrgPerson object class, configure the arguments in the configuration entry as follows:

   nsslapd-pluginarg0: employeeNumber
   nsslapd-pluginarg1: uid
   nsslapd-pluginarg2: MarkerObjectClass="organization"
    RequiredObjectClass="inetOrgPerson"

Dependencies

database type

Performance Related Information

Directory Server provides the UID Uniqueness plug-in by default. To ensure unique values for other attributes, you can create instances of the UID Uniqueness plug-in for those attributes.

The UID Uniqueness plug-in may slow down Directory Server performance.

URI PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

URI Syntax

DN of Configuration Entry

cn=URI Syntax,cn=plugins,cn=config

Description

Syntax for handling URIs (Unique Resource Identifiers) including URLs (Unique Resource Locators.)

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised June 2010

Name | Description | Attributes | See Also

nsslapd-pluginDescription(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-plugin, nsslapd-plugin-depends-on-named, nsslapd-plugin-depends-on-type, nsslapd-pluginDescription, nsslapd-pluginEnabled, nsslapd-pluginId, nsslapd-pluginInitfunc, nsslapd-pluginPath, nsslapd-pluginType, nsslapd-pluginVendor, nsslapd-pluginVersion – Directory Server plug-in legacy configuration

Description

The nsslapd-plugin attribute on cn=config is multi-valued, read-only attribute lists the syntaxes and matching rules loaded by the server. This manual page covers server plug-in configuration, rather than the nsslapd-plugin attribute.

This manual page provides an overview of legacy configuration information for server plug-ins. This manual page covers the individual plug-in configuration entry attributes. Also, this manual page covers the plug-ins provided with Directory Server, including configurable options, configurable arguments, default setting, dependencies, general performance related information, and further reading.

---

Note –

In most circumstances, you configure plug-in functionality using the dsconf(1M) command. See plugin(5dsconf) for a list of configurable properties.

---

ATTRIBUTES FOR PLUG-IN CONFIGURATION ENTRIES

The following list covers each plug-in configuration entry attribute.

nsslapd-plugin-depends-on-named

This is a multivalued attribute, used to ensure that plug-ins are called by the server in the correct order. It takes a value that corresponds to the cn value of a plug-in. The plug-in whose cn value matches one of the values below it is started by the server prior to this plug-in. If the plug-in does not exist, the server fails to start.

Entry DN

cn=pluginName,cn=plugins, cn=config

Valid Range

Plug-in name

Default Value

None

Syntax

DirectoryString

Example

nsslapd-plugin-depends-on-named: Class of Service

nsslapd-plugin-depends-on-type

This is a multivalued attribute, used to ensure that plug-ins are called by the server in the correct order. It takes a value that corresponds to the type of a plug-in, contained in the attribute nsslapd-pluginType, and requires that plug-ins of that type are started before the present plug-in.

Entry DN

cn=pluginName,cn=plugins, cn=config

Valid Range

Plug-in type

Default Value

None

Syntax

DirectoryString

Example

nsslapd-plugin-depends-on-type: database

nsslapd-pluginDescription

Provides a description of the plug-in.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any DirectoryString

Default Value

None

Syntax

DirectoryString

Example

nsslapd-pluginDescription: acl access check plug-in

nsslapd-pluginEnabled

Specifies whether or not the plug-in is enabled. This attribute can be changed over protocol, but will only take effect when the server is next restarted.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

on | off

Default Value

on

Syntax

DirectoryString

Example

nsslapd-pluginEnabled: on

nsslapd-pluginId

Specifies the plug-in ID.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any valid plug-in ID.

Default Value

None

Syntax

DirectoryString

Example

nsslapd-pluginId: chaining database

nsslapd-pluginInitfunc

Specifies the plug-in function to be initiated.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any valid plug-in function.

Default Value

None

Syntax

DirectoryString

Example

nsslapd-pluginInitfunc: NS7bitAttr_Init

nsslapd-pluginPath

Specifies the full path to the plug-in.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any valid path

Default Value

None

Syntax

DirectoryString

Example

nsslapd-pluginPath: /opt/SUNWdsee7/lib/sparcv9/uid-plugin.so

nsslapd-pluginType

Specifies the plug-in type.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any valid plug-in type.

Default Value

None

Syntax

DirectoryString

Example

nsslapd-pluginType: preoperation

nsslapd-pluginVendor

Specifies the vendor of the plug-in.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any approved plug-in vendor.

Default Value

Sun Microsystems, Inc.

Syntax

DirectoryString

Example

nsslapd-pluginVendor: Sun Microsystems, Inc.

nsslapd-pluginVersion

Specifies the plug-in version.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any valid plug-in version.

Default Value

Product version

Syntax

DirectoryString

Example

nsslapd-pluginVersion: 11.1.1.3.0

7-BIT CHECK PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

7-Bit Check (NS7bitAttr)

DN of Configuration Entry

cn=7-bit check,cn=plugins,cn=config

Description

Checks certain attributes are seven-bit clean.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

List of attributes, uid mail userpassword, followed by a comma, and then by the suffix or suffixes on which the check is to occur.

Dependencies

None

Performance Related Information

None

Further Information

If your Directory Server uses non-ASCII characters such as Japanese and other languages for some attributes, remove those attributes from the list of attributes checked by this plug-in.

When adding or modifying an attribute value checked by this plug-in, and the new value violates the seven-bit check, the client receives a LDAP_CONSTRAINT_VIOLATION (19) return code, and a message such as the following: Value of attribute attr contains extended (8-bit) characters: value

ACL PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

ACL Plugin

DN of Configuration Entry

cn=ACL Plugin,cn=plugins,cn=config

Description

ACL access check plug-in

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Leave this plug-in running at all times.

ACL PREOPERATION PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

ACL preoperation

DN of Configuration Entry

cn=ACL preoperation,cn=plugins,cn=config

Description

ACL access check plug-in.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

Database

Performance Related Information

Leave this plug-in running at all times.

BINARY SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Binary Syntax

DN of Configuration Entry

cn=Binary Syntax,cn=plugins,cn=config

Description

Syntax for handling binary data.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

BOOLEAN SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Boolean Syntax

DN of Configuration Entry

cn=Boolean Syntax,cn=plugins,cn=config

Description

Syntax for handling booleans.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CASE EXACT STRING SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Case Exact String Syntax

DN of Configuration Entry

cn=Case Exact String Syntax,cn=plugins,cn=config

Description

Syntax for handling case-sensitive strings.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CASE IGNORE STRING SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Case Ignore String Syntax

DN of Configuration Entry

cn=Case Ignore String Syntax,cn=plugins,cn=config

Description

Syntax for handling case-insensitive strings.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CHAINING DATABASE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Chaining Database

DN of Configuration Entry

cn=Chaining database,cn=plugins,cn=config

Description

Syntax for handling DNs.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CLASS OF SERVICE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Class of Service

DN of Configuration Entry

cn=Class of Service,cn=plugins,cn=config

Description

Allows for sharing of attributes between entries.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

Set the nsslapd-pluginarg0 attribute to:

• 0 (default) to enable fast lookup of classic CoS templates

• 1 to disable fast lookup for classic CoS template selection

• 2 to disable checks for ambiguous pointer and classic CoS definitions

  Ambiguous definitions result when more than one value could be returned for the same attribute of the same entry. When checking remains enabled, Directory Server logs an informational message upon encountering such an ambiguity, provided you have set the log level to allow plug-ins to log informational messages.

• 3 to disable both

Restart Directory Server for modifications to take effect.

Dependencies

None

Performance Related Information

Leave this plug-in running at all times.

COUNTRY STRING SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Country String Syntax

DN of Configuration Entry

cn=Country String Syntax,cn=plugins,cn=config

Description

Syntax for handling countries.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

DISTINGUISHED NAME SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Distinguished Name Syntax

DN of Configuration Entry

cn=Distinguished Name Syntax,cn=plugins,cn=config

Description

Syntax for handling DNs.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

DSML FRONTEND SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Frontend

DN of Configuration Entry

cn=DSMLv2-SOAP-HTTP,cn=frontends,cn=plugins, cn=config

Description

Enables you to access the directory using DSML v2 over SOAP/HTTP.

Configurable Options

on | off

Default Setting

off

Configurable Arguments

ds-hdsml-soapschemalocation

ds-hdsml-dsmlschemalocation

Dependencies

None

Performance Related Information

None

GENERALIZED TIME SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Generalized Time Syntax

DN of Configuration Entry

cn=Generalized Time Syntax,cn=plugins,cn=config

Description

Syntax for dealing with dates, times, and time zones.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

Further Information

The Generalized Time String consists of the four digit year, two digit month (for example, 01 for January), two digit day, two digit hour, two digit minute, two digit second, an optional decimal part of a second and a time zone indication. We strongly recommend that you use the Z time zone indication (Greenwich Mean Time).

INTEGER SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Integer Syntax

DN of Configuration Entry

cn=Integer Syntax,cn=plugins,cn=config

Description

Syntax for handling integers.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

INTERNATIONALIZATION PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Internationalization Plugin

DN of Configuration Entry

cn=Internationalization Plugin,cn=plugins,cn=config

Description

Syntax for handling DNs.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None. In contrast to previous versions of Directory Server, the collation orders and locales used by the internationalization plug-in are now stored in the configuration.

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

LDBM DATABASE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

ldbm database plug-in

DN of Configuration Entry

cn=ldbm database plug-in,cn=plugins,cn=config

Description

Implements local databases.

Configurable Options

None

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Leave this plug-in running at all times.

MULTIMASTER REPLICATION PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Multimaster Replication Plugin

DN of Configuration Entry

cn=Multimaster Replication plugin,cn=plugins, cn=config

Description

Enables replication between two Directory Server suffixes.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

database

Performance Related Information

None

Further Information

You can turn this plug-in off if you have only one server, which will never replicate.

OCTET STRING SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Octet String Syntax

DN of Configuration Entry

cn=Octet String Syntax,cn=plugins,cn=config

Description

Syntax for handling octet strings.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CLEAR PASSWORD STORAGE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

CLEAR

DN of Configuration Entry

cn=CLEAR,cn=Password Storage Schemes,cn=plugins, cn=config

Description

CLEAR password storage scheme used for password encryption.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CRYPT PASSWORD STORAGE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

CRYPT

DN of Configuration Entry

cn=CRYPT,cn=Password Storage Schemes,cn=plugins, cn=config

Description

CRYPT password storage scheme used for password encryption.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

NS-MTA-MD5 PASSWORD STORAGE SCHEME PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

NS-MTA-MD5

DN of Configuration Entry

cn=NS-MTA-MD5,cn=Password Storage Schemes, cn=plugins,cn=config

Description

NS-MTA-MD5 password storage scheme for password encryption.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

Further Information

You can no longer choose to encrypt passwords using the NS-MTA-MD5 password storage scheme. The storage scheme is still present, but for backward compatibility only. The data in your directory still contains passwords encrypted with the NS-MTA-MD5 password storage scheme.

RMCE PASSWORD STORAGE SCHEME PLUG-IN

This password storage scheme plug-in is used for example by the administration framework and is reserved for internal use.

SHA PASSWORD STORAGE SCHEME PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

SHA

DN of Configuration Entry

cn=SHA,cn=Password Storage Schemes,cn=plugins, cn=config

Description

SHA password storage scheme for password encryption.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

If there are no passwords encrypted using the SHA password storage scheme, you may turn this plug-in off. If you want to encrypt your password with the SHA password storage scheme, choose SSHA instead. SSHA is a far more secure option.

SSHA PASSWORD STORAGE SCHEME PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

SSHA

DN of Configuration Entry

cn=SSHA,cn=Password Storage Schemes,cn=plugins, cn=config

Description

SSHA password storage scheme for password encryption.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

STRONG PASSWORD CHECK PLUG-IN

When Directory Server is configured to check password quality, and this plug-in is enabled, the plug-in checks the following each time a password is added or modified.

• Clear text password values contain the classes of characters specified by the configuration.

• Clear text password values do not contain any sequence of four characters present in the dictionary file specified by the configuration.

Hashed password values such as {SSHA}0Ri1g2yqlH3GTZcuRQ4uS22syCQLBKAU2ypLSw== are not checked.

Consider the following aspects of this plug-in.

Plug-In Name

Strong Password Checking plug-in

DN of Configuration Entry

cn=Strong Password Check,cn=plugins,cn=config

Configurable options and arguments

on | off

nsslapd-pluginarg0, which takes an integer representing a mask of values representing the character classes that must be present in a valid password. Set nsslapd-pluginarg0 to one of or a sum of the following values, not counting the special values 16 and 17.

• 1 means the password must contain special characters.

• 2 means the password must contain numeric characters.

• 4 means the password must contain upper case characters.

• 8 means the password must contain lower case characters.

• 16 is a special value meaning at least three of the four character classes.

• 17 is a special value meaning at least two of the four character classes.

The default setting is 15.

nsslapd-pluginarg1, which takes the absolute file system path to an ASCII dictionary file. If the argument is missing, the dictionary check is skipped. The plug-in does not initialize and Directory Server does not start if the value of this attribute is invalid or refers to an inaccessible file.

Default settings

off

Dependencies

Default password file, install-path/resources/plugins/words-english-big.txt

POSTAL ADDRESS STRING SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Postal Address Syntax

DN of Configuration Entry

cn=Postal Address Syntax,cn=plugins,cn=config

Description

Syntax used for handling postal addresses.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

PTA PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Pass Through Authentication

DN of Configuration Entry

cn=Pass Through Authentication,cn=plugins, cn=config

Description

Enables pass-through authentication, the mechanism that allows one directory to consult another to authenticate bind requests.

Configurable Options

on | off

Default Setting

off

Configurable Arguments

The LDAP URL to the configuration directory.

nsslapd-pluginarg0: ldap://config.example.com/o=example

Dependencies

None

REFERENTIAL INTEGRITY POSTOPERATION PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Referential Integrity Postoperation

DN of Configuration Entry

cn=Referential Integrity Postoperation, cn=plugins,cn=config

Description

Enables the server to ensure referential integrity.

All attributes in all databases that are used by the referential integrity plug-in must be indexed. The indexes need to be created in the configuration of all the databases. When the retro change log is enabled, the cn=changelog suffix must be indexed.

Configurable Options

All configuration and on | off

Default Setting

off

Configurable Arguments

When enabled, the post operation Referential Integrity plug-in performs integrity updates on the member, uniquemember, owner, and seeAlso attributes immediately after a delete or rename operation. You can reconfigure the plug-in to perform integrity checks on all other attributes.

The following arguments are configurable:

1. (nsslapd-pluginarg0) Check for referential integrity

   -1 = no check for referential integrity

   0 = check for referential integrity is performed immediately

   positive integer = request for referential integrity is queued and processed at a later stage. This positive integer serves as a wake-up call for the thread to process the request, at intervals corresponding to the integer specified.

2. (nsslapd-pluginarg1) Log file for storing the change, for example /local/dsInst/logs/referint

3. (nsslapd-pluginarg2) Reserved for future use.

4. (Other nsslapd-pluginarg* attributes) Attribute names to be checked for referential integrity.

Dependencies

database type

Tuning Recommendations

Do the following when you use the referential integrity plug-in in a multi-master replication environment:

• Enable the referential integrity plug-in on all servers containing master replicas

• Enable the referential integrity plug-in with the same configuration on every master

Set the first argument to a positive value, such as 10, meaning ten seconds, to ensure that work performed by this plug-in happens asynchronously, rather than synchronously.

When enabling the plug-in, also create equality indexes for all attributes configured for use with the plug-in. The plug-in uses such indexes when searching for entries to update. Without equality indexes for the attributes it uses, the plug-in must perform costly unindexed searches that have negative impact on performance.

RETRO CHANGE LOG PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Retro Changelog Plugin

DN of Configuration Entry

cn=Retro Changelog Plugin,cn=plugins,cn=config

Description

Used by LDAP clients for maintaining application compatibility with Directory Server 4.x versions.

Maintains a log of all changes occurring in Directory Server. The retro change log offers the same functionality as the changelog in the 4.x versions of Directory Server.

Configurable Options

on | off

Default Setting

off

Configurable Arguments

The following arguments can be configured for the retro change log plug-in:

• nsslapd-pluginarg0: -ignore_attributesconfigures the retro change log plug-in to ignore attributes specified by the following nsslapd-pluginarg. This argument is configured by default.

• nsslapd-pluginarg1: copyingFromspecifies a list of attributes to be ignored by the preceding nsslapd-pluginarg. This argument is configured by default.

• nsslapd-pluginarg2: suffixes="suffix1","suffix2" configures the retro change log to record updates to specified suffixes only

• nsslapd-pluginarg3: deletedEntryAttributes=attribute1,attribute2 configures the retro change log to record specified attributes of an entry when that entry is deleted

Dependencies

None

Performance Related Information

May slow down Directory Server performance.

Example Configuration

dn: cn=Retro Changelog Plugin,cn=plugins,cn=config
objectClass: top
objectClass: nsSlapdPlugin
objectClass: ds-signedPlugin
objectClass: extensibleObject
cn: Retro Changelog Plugin
nsslapd-pluginPath: /opt/SUNWdsee7/lib/sparcv9/retrocl-plugin.so
nsslapd-pluginInitfunc: retrocl_plugin_init
nsslapd-pluginType: object
nsslapd-plugin-depends-on-type: database
nsslapd-pluginarg0: -ignore_attributes
nsslapd-pluginarg1: copyingFrom
nsslapd-pluginarg2: suffixes="ou=people","dc=example","dc=com"
nsslapd-pluginarg3: deletedEntryAtrributes="objectclass","employeenumber"
nsslapd-changelogdir: /local/dsInst/db/changelog
nsslapd-pluginEnabled: on
nsslapd-pluginId: retrocl
nsslapd-pluginVersion: 11.1.1.3.0
nsslapd-pluginVendor: Sun Microsystems, Inc.
nsslapd-pluginDescription: Retrocl Plugin
ds-pluginSignatureState: valid signature

ROLES PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Roles Plugin

DN of Configuration Entry

cn=Roles Plugin,cn=plugins,cn=config

Description

Enables the use of roles in Directory Server.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

State Change Plugin

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

STATE CHANGE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

State Change Plugin

DN of Configuration Entry

cn=State Change Plugin,cn=plugins,cn=config

Description

State change notification service plug-in for detecting updates, such as configuration changes, and triggering callbacks when updates happen.

This plug-in is used internally by the roles plug-in.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

SUBTREE ENTRY COUNTER PLUG-INS

Consider the following aspects of this plug-in.

Plug-In Name

Subtree Entry Counter For ObjectClass

DN of Configuration Entry

cn=Subtree Entry Counter for ObjectClass,cn=plugins, cn=config

Description

Maintain a count of entries with a particular object class. The following plug-ins are provided.

• Subtree entry counter for departments in domains

• Subtree entry counter for domains within a domain

• Subtree entry counter for mail lists

• Subtree entry counter for nested departments

• Subtree entry counter for total domains

• Subtree entry counter for users

Configurable Options

on | off

Default Setting

off

Configurable Arguments

None

Dependencies

None

Performance Related Information

These plug-ins are provided for use with Messaging Server only, and are disabled by default. Leave these plug-ins disabled unless your Messaging Server requires them.

Counter Attributes Maintained

nsNumDepts

Either the number of departments within a domain, or the number of departments within a department (nested departments), depending on the DN of the entry.

nsNumDomains

Either the number of total domains, or the number of domains within a domain or nested domain, depending on the DN of the entry.

nsNumMailLists

Number of mail lists.

TELEPHONE SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Telephone Syntax

DN of Configuration Entry

cn=Telephone Syntax,cn=plugins,cn=config

Description

Syntax for handling telephone numbers.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

UID UNIQUENESS PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

UID Uniqueness

DN of Configuration Entry

cn=UID Uniqueness,cn=plugins,cn=config

Description

Checks that the values of specified attributes are unique each time a modification occurs on an entry.

Configurable Options

on | off

Default Setting

off

Configurable Arguments

You may configure this plug-in in either of two different ways.

1. Specify attributes that must be unique for a series of one or more subtrees identified by DNs. For example, to specify that employeeNumber and uid attribute values must be unique across both o=org1,dc=example,dc=com and o=org2,dc=example,dc=com , configure the arguments in the configuration entry as follows:

   nsslapd-pluginarg0: employeeNumber
   nsslapd-pluginarg1: uid
   nsslapd-pluginarg2: o=org1,dc=example,dc=com
   nsslapd-pluginarg3: o=org2,dc=example,dc=com

2. You specify attributes that must be unique inside congruent subtrees, optionally only on entries of a specified object class. For example, to specify that employeeNumber and uid attribute values must be unique in either o=org1,dc=example,dc=com or o=org2,dc=example,dc=com, but only on entries of the inetOrgPerson object class, configure the arguments in the configuration entry as follows:

   nsslapd-pluginarg0: employeeNumber
   nsslapd-pluginarg1: uid
   nsslapd-pluginarg2: MarkerObjectClass="organization"
    RequiredObjectClass="inetOrgPerson"

Dependencies

database type

Performance Related Information

Directory Server provides the UID Uniqueness plug-in by default. To ensure unique values for other attributes, you can create instances of the UID Uniqueness plug-in for those attributes.

The UID Uniqueness plug-in may slow down Directory Server performance.

URI PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

URI Syntax

DN of Configuration Entry

cn=URI Syntax,cn=plugins,cn=config

Description

Syntax for handling URIs (Unique Resource Identifiers) including URLs (Unique Resource Locators.)

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised June 2010

Name | Description | Attributes | See Also

nsslapd-pluginEnabled(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-plugin, nsslapd-plugin-depends-on-named, nsslapd-plugin-depends-on-type, nsslapd-pluginDescription, nsslapd-pluginEnabled, nsslapd-pluginId, nsslapd-pluginInitfunc, nsslapd-pluginPath, nsslapd-pluginType, nsslapd-pluginVendor, nsslapd-pluginVersion – Directory Server plug-in legacy configuration

Description

The nsslapd-plugin attribute on cn=config is multi-valued, read-only attribute lists the syntaxes and matching rules loaded by the server. This manual page covers server plug-in configuration, rather than the nsslapd-plugin attribute.

This manual page provides an overview of legacy configuration information for server plug-ins. This manual page covers the individual plug-in configuration entry attributes. Also, this manual page covers the plug-ins provided with Directory Server, including configurable options, configurable arguments, default setting, dependencies, general performance related information, and further reading.

---

Note –

In most circumstances, you configure plug-in functionality using the dsconf(1M) command. See plugin(5dsconf) for a list of configurable properties.

---

ATTRIBUTES FOR PLUG-IN CONFIGURATION ENTRIES

The following list covers each plug-in configuration entry attribute.

nsslapd-plugin-depends-on-named

This is a multivalued attribute, used to ensure that plug-ins are called by the server in the correct order. It takes a value that corresponds to the cn value of a plug-in. The plug-in whose cn value matches one of the values below it is started by the server prior to this plug-in. If the plug-in does not exist, the server fails to start.

Entry DN

cn=pluginName,cn=plugins, cn=config

Valid Range

Plug-in name

Default Value

None

Syntax

DirectoryString

Example

nsslapd-plugin-depends-on-named: Class of Service

nsslapd-plugin-depends-on-type

This is a multivalued attribute, used to ensure that plug-ins are called by the server in the correct order. It takes a value that corresponds to the type of a plug-in, contained in the attribute nsslapd-pluginType, and requires that plug-ins of that type are started before the present plug-in.

Entry DN

cn=pluginName,cn=plugins, cn=config

Valid Range

Plug-in type

Default Value

None

Syntax

DirectoryString

Example

nsslapd-plugin-depends-on-type: database

nsslapd-pluginDescription

Provides a description of the plug-in.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any DirectoryString

Default Value

None

Syntax

DirectoryString

Example

nsslapd-pluginDescription: acl access check plug-in

nsslapd-pluginEnabled

Specifies whether or not the plug-in is enabled. This attribute can be changed over protocol, but will only take effect when the server is next restarted.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

on | off

Default Value

on

Syntax

DirectoryString

Example

nsslapd-pluginEnabled: on

nsslapd-pluginId

Specifies the plug-in ID.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any valid plug-in ID.

Default Value

None

Syntax

DirectoryString

Example

nsslapd-pluginId: chaining database

nsslapd-pluginInitfunc

Specifies the plug-in function to be initiated.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any valid plug-in function.

Default Value

None

Syntax

DirectoryString

Example

nsslapd-pluginInitfunc: NS7bitAttr_Init

nsslapd-pluginPath

Specifies the full path to the plug-in.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any valid path

Default Value

None

Syntax

DirectoryString

Example

nsslapd-pluginPath: /opt/SUNWdsee7/lib/sparcv9/uid-plugin.so

nsslapd-pluginType

Specifies the plug-in type.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any valid plug-in type.

Default Value

None

Syntax

DirectoryString

Example

nsslapd-pluginType: preoperation

nsslapd-pluginVendor

Specifies the vendor of the plug-in.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any approved plug-in vendor.

Default Value

Sun Microsystems, Inc.

Syntax

DirectoryString

Example

nsslapd-pluginVendor: Sun Microsystems, Inc.

nsslapd-pluginVersion

Specifies the plug-in version.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any valid plug-in version.

Default Value

Product version

Syntax

DirectoryString

Example

nsslapd-pluginVersion: 11.1.1.3.0

7-BIT CHECK PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

7-Bit Check (NS7bitAttr)

DN of Configuration Entry

cn=7-bit check,cn=plugins,cn=config

Description

Checks certain attributes are seven-bit clean.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

List of attributes, uid mail userpassword, followed by a comma, and then by the suffix or suffixes on which the check is to occur.

Dependencies

None

Performance Related Information

None

Further Information

If your Directory Server uses non-ASCII characters such as Japanese and other languages for some attributes, remove those attributes from the list of attributes checked by this plug-in.

When adding or modifying an attribute value checked by this plug-in, and the new value violates the seven-bit check, the client receives a LDAP_CONSTRAINT_VIOLATION (19) return code, and a message such as the following: Value of attribute attr contains extended (8-bit) characters: value

ACL PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

ACL Plugin

DN of Configuration Entry

cn=ACL Plugin,cn=plugins,cn=config

Description

ACL access check plug-in

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Leave this plug-in running at all times.

ACL PREOPERATION PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

ACL preoperation

DN of Configuration Entry

cn=ACL preoperation,cn=plugins,cn=config

Description

ACL access check plug-in.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

Database

Performance Related Information

Leave this plug-in running at all times.

BINARY SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Binary Syntax

DN of Configuration Entry

cn=Binary Syntax,cn=plugins,cn=config

Description

Syntax for handling binary data.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

BOOLEAN SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Boolean Syntax

DN of Configuration Entry

cn=Boolean Syntax,cn=plugins,cn=config

Description

Syntax for handling booleans.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CASE EXACT STRING SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Case Exact String Syntax

DN of Configuration Entry

cn=Case Exact String Syntax,cn=plugins,cn=config

Description

Syntax for handling case-sensitive strings.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CASE IGNORE STRING SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Case Ignore String Syntax

DN of Configuration Entry

cn=Case Ignore String Syntax,cn=plugins,cn=config

Description

Syntax for handling case-insensitive strings.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CHAINING DATABASE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Chaining Database

DN of Configuration Entry

cn=Chaining database,cn=plugins,cn=config

Description

Syntax for handling DNs.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CLASS OF SERVICE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Class of Service

DN of Configuration Entry

cn=Class of Service,cn=plugins,cn=config

Description

Allows for sharing of attributes between entries.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

Set the nsslapd-pluginarg0 attribute to:

• 0 (default) to enable fast lookup of classic CoS templates

• 1 to disable fast lookup for classic CoS template selection

• 2 to disable checks for ambiguous pointer and classic CoS definitions

  Ambiguous definitions result when more than one value could be returned for the same attribute of the same entry. When checking remains enabled, Directory Server logs an informational message upon encountering such an ambiguity, provided you have set the log level to allow plug-ins to log informational messages.

• 3 to disable both

Restart Directory Server for modifications to take effect.

Dependencies

None

Performance Related Information

Leave this plug-in running at all times.

COUNTRY STRING SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Country String Syntax

DN of Configuration Entry

cn=Country String Syntax,cn=plugins,cn=config

Description

Syntax for handling countries.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

DISTINGUISHED NAME SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Distinguished Name Syntax

DN of Configuration Entry

cn=Distinguished Name Syntax,cn=plugins,cn=config

Description

Syntax for handling DNs.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

DSML FRONTEND SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Frontend

DN of Configuration Entry

cn=DSMLv2-SOAP-HTTP,cn=frontends,cn=plugins, cn=config

Description

Enables you to access the directory using DSML v2 over SOAP/HTTP.

Configurable Options

on | off

Default Setting

off

Configurable Arguments

ds-hdsml-soapschemalocation

ds-hdsml-dsmlschemalocation

Dependencies

None

Performance Related Information

None

GENERALIZED TIME SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Generalized Time Syntax

DN of Configuration Entry

cn=Generalized Time Syntax,cn=plugins,cn=config

Description

Syntax for dealing with dates, times, and time zones.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

Further Information

The Generalized Time String consists of the four digit year, two digit month (for example, 01 for January), two digit day, two digit hour, two digit minute, two digit second, an optional decimal part of a second and a time zone indication. We strongly recommend that you use the Z time zone indication (Greenwich Mean Time).

INTEGER SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Integer Syntax

DN of Configuration Entry

cn=Integer Syntax,cn=plugins,cn=config

Description

Syntax for handling integers.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

INTERNATIONALIZATION PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Internationalization Plugin

DN of Configuration Entry

cn=Internationalization Plugin,cn=plugins,cn=config

Description

Syntax for handling DNs.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None. In contrast to previous versions of Directory Server, the collation orders and locales used by the internationalization plug-in are now stored in the configuration.

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

LDBM DATABASE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

ldbm database plug-in

DN of Configuration Entry

cn=ldbm database plug-in,cn=plugins,cn=config

Description

Implements local databases.

Configurable Options

None

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Leave this plug-in running at all times.

MULTIMASTER REPLICATION PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Multimaster Replication Plugin

DN of Configuration Entry

cn=Multimaster Replication plugin,cn=plugins, cn=config

Description

Enables replication between two Directory Server suffixes.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

database

Performance Related Information

None

Further Information

You can turn this plug-in off if you have only one server, which will never replicate.

OCTET STRING SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Octet String Syntax

DN of Configuration Entry

cn=Octet String Syntax,cn=plugins,cn=config

Description

Syntax for handling octet strings.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CLEAR PASSWORD STORAGE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

CLEAR

DN of Configuration Entry

cn=CLEAR,cn=Password Storage Schemes,cn=plugins, cn=config

Description

CLEAR password storage scheme used for password encryption.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CRYPT PASSWORD STORAGE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

CRYPT

DN of Configuration Entry

cn=CRYPT,cn=Password Storage Schemes,cn=plugins, cn=config

Description

CRYPT password storage scheme used for password encryption.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

NS-MTA-MD5 PASSWORD STORAGE SCHEME PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

NS-MTA-MD5

DN of Configuration Entry

cn=NS-MTA-MD5,cn=Password Storage Schemes, cn=plugins,cn=config

Description

NS-MTA-MD5 password storage scheme for password encryption.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

Further Information

You can no longer choose to encrypt passwords using the NS-MTA-MD5 password storage scheme. The storage scheme is still present, but for backward compatibility only. The data in your directory still contains passwords encrypted with the NS-MTA-MD5 password storage scheme.

RMCE PASSWORD STORAGE SCHEME PLUG-IN

This password storage scheme plug-in is used for example by the administration framework and is reserved for internal use.

SHA PASSWORD STORAGE SCHEME PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

SHA

DN of Configuration Entry

cn=SHA,cn=Password Storage Schemes,cn=plugins, cn=config

Description

SHA password storage scheme for password encryption.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

If there are no passwords encrypted using the SHA password storage scheme, you may turn this plug-in off. If you want to encrypt your password with the SHA password storage scheme, choose SSHA instead. SSHA is a far more secure option.

SSHA PASSWORD STORAGE SCHEME PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

SSHA

DN of Configuration Entry

cn=SSHA,cn=Password Storage Schemes,cn=plugins, cn=config

Description

SSHA password storage scheme for password encryption.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

STRONG PASSWORD CHECK PLUG-IN

When Directory Server is configured to check password quality, and this plug-in is enabled, the plug-in checks the following each time a password is added or modified.

• Clear text password values contain the classes of characters specified by the configuration.

• Clear text password values do not contain any sequence of four characters present in the dictionary file specified by the configuration.

Hashed password values such as {SSHA}0Ri1g2yqlH3GTZcuRQ4uS22syCQLBKAU2ypLSw== are not checked.

Consider the following aspects of this plug-in.

Plug-In Name

Strong Password Checking plug-in

DN of Configuration Entry

cn=Strong Password Check,cn=plugins,cn=config

Configurable options and arguments

on | off

nsslapd-pluginarg0, which takes an integer representing a mask of values representing the character classes that must be present in a valid password. Set nsslapd-pluginarg0 to one of or a sum of the following values, not counting the special values 16 and 17.

• 1 means the password must contain special characters.

• 2 means the password must contain numeric characters.

• 4 means the password must contain upper case characters.

• 8 means the password must contain lower case characters.

• 16 is a special value meaning at least three of the four character classes.

• 17 is a special value meaning at least two of the four character classes.

The default setting is 15.

nsslapd-pluginarg1, which takes the absolute file system path to an ASCII dictionary file. If the argument is missing, the dictionary check is skipped. The plug-in does not initialize and Directory Server does not start if the value of this attribute is invalid or refers to an inaccessible file.

Default settings

off

Dependencies

Default password file, install-path/resources/plugins/words-english-big.txt

POSTAL ADDRESS STRING SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Postal Address Syntax

DN of Configuration Entry

cn=Postal Address Syntax,cn=plugins,cn=config

Description

Syntax used for handling postal addresses.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

PTA PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Pass Through Authentication

DN of Configuration Entry

cn=Pass Through Authentication,cn=plugins, cn=config

Description

Enables pass-through authentication, the mechanism that allows one directory to consult another to authenticate bind requests.

Configurable Options

on | off

Default Setting

off

Configurable Arguments

The LDAP URL to the configuration directory.

nsslapd-pluginarg0: ldap://config.example.com/o=example

Dependencies

None

REFERENTIAL INTEGRITY POSTOPERATION PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Referential Integrity Postoperation

DN of Configuration Entry

cn=Referential Integrity Postoperation, cn=plugins,cn=config

Description

Enables the server to ensure referential integrity.

All attributes in all databases that are used by the referential integrity plug-in must be indexed. The indexes need to be created in the configuration of all the databases. When the retro change log is enabled, the cn=changelog suffix must be indexed.

Configurable Options

All configuration and on | off

Default Setting

off

Configurable Arguments

When enabled, the post operation Referential Integrity plug-in performs integrity updates on the member, uniquemember, owner, and seeAlso attributes immediately after a delete or rename operation. You can reconfigure the plug-in to perform integrity checks on all other attributes.

The following arguments are configurable:

1. (nsslapd-pluginarg0) Check for referential integrity

   -1 = no check for referential integrity

   0 = check for referential integrity is performed immediately

   positive integer = request for referential integrity is queued and processed at a later stage. This positive integer serves as a wake-up call for the thread to process the request, at intervals corresponding to the integer specified.

2. (nsslapd-pluginarg1) Log file for storing the change, for example /local/dsInst/logs/referint

3. (nsslapd-pluginarg2) Reserved for future use.

4. (Other nsslapd-pluginarg* attributes) Attribute names to be checked for referential integrity.

Dependencies

database type

Tuning Recommendations

Do the following when you use the referential integrity plug-in in a multi-master replication environment:

• Enable the referential integrity plug-in on all servers containing master replicas

• Enable the referential integrity plug-in with the same configuration on every master

Set the first argument to a positive value, such as 10, meaning ten seconds, to ensure that work performed by this plug-in happens asynchronously, rather than synchronously.

When enabling the plug-in, also create equality indexes for all attributes configured for use with the plug-in. The plug-in uses such indexes when searching for entries to update. Without equality indexes for the attributes it uses, the plug-in must perform costly unindexed searches that have negative impact on performance.

RETRO CHANGE LOG PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Retro Changelog Plugin

DN of Configuration Entry

cn=Retro Changelog Plugin,cn=plugins,cn=config

Description

Used by LDAP clients for maintaining application compatibility with Directory Server 4.x versions.

Maintains a log of all changes occurring in Directory Server. The retro change log offers the same functionality as the changelog in the 4.x versions of Directory Server.

Configurable Options

on | off

Default Setting

off

Configurable Arguments

The following arguments can be configured for the retro change log plug-in:

• nsslapd-pluginarg0: -ignore_attributesconfigures the retro change log plug-in to ignore attributes specified by the following nsslapd-pluginarg. This argument is configured by default.

• nsslapd-pluginarg1: copyingFromspecifies a list of attributes to be ignored by the preceding nsslapd-pluginarg. This argument is configured by default.

• nsslapd-pluginarg2: suffixes="suffix1","suffix2" configures the retro change log to record updates to specified suffixes only

• nsslapd-pluginarg3: deletedEntryAttributes=attribute1,attribute2 configures the retro change log to record specified attributes of an entry when that entry is deleted

Dependencies

None

Performance Related Information

May slow down Directory Server performance.

Example Configuration

dn: cn=Retro Changelog Plugin,cn=plugins,cn=config
objectClass: top
objectClass: nsSlapdPlugin
objectClass: ds-signedPlugin
objectClass: extensibleObject
cn: Retro Changelog Plugin
nsslapd-pluginPath: /opt/SUNWdsee7/lib/sparcv9/retrocl-plugin.so
nsslapd-pluginInitfunc: retrocl_plugin_init
nsslapd-pluginType: object
nsslapd-plugin-depends-on-type: database
nsslapd-pluginarg0: -ignore_attributes
nsslapd-pluginarg1: copyingFrom
nsslapd-pluginarg2: suffixes="ou=people","dc=example","dc=com"
nsslapd-pluginarg3: deletedEntryAtrributes="objectclass","employeenumber"
nsslapd-changelogdir: /local/dsInst/db/changelog
nsslapd-pluginEnabled: on
nsslapd-pluginId: retrocl
nsslapd-pluginVersion: 11.1.1.3.0
nsslapd-pluginVendor: Sun Microsystems, Inc.
nsslapd-pluginDescription: Retrocl Plugin
ds-pluginSignatureState: valid signature

ROLES PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Roles Plugin

DN of Configuration Entry

cn=Roles Plugin,cn=plugins,cn=config

Description

Enables the use of roles in Directory Server.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

State Change Plugin

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

STATE CHANGE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

State Change Plugin

DN of Configuration Entry

cn=State Change Plugin,cn=plugins,cn=config

Description

State change notification service plug-in for detecting updates, such as configuration changes, and triggering callbacks when updates happen.

This plug-in is used internally by the roles plug-in.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

SUBTREE ENTRY COUNTER PLUG-INS

Consider the following aspects of this plug-in.

Plug-In Name

Subtree Entry Counter For ObjectClass

DN of Configuration Entry

cn=Subtree Entry Counter for ObjectClass,cn=plugins, cn=config

Description

Maintain a count of entries with a particular object class. The following plug-ins are provided.

• Subtree entry counter for departments in domains

• Subtree entry counter for domains within a domain

• Subtree entry counter for mail lists

• Subtree entry counter for nested departments

• Subtree entry counter for total domains

• Subtree entry counter for users

Configurable Options

on | off

Default Setting

off

Configurable Arguments

None

Dependencies

None

Performance Related Information

These plug-ins are provided for use with Messaging Server only, and are disabled by default. Leave these plug-ins disabled unless your Messaging Server requires them.

Counter Attributes Maintained

nsNumDepts

Either the number of departments within a domain, or the number of departments within a department (nested departments), depending on the DN of the entry.

nsNumDomains

Either the number of total domains, or the number of domains within a domain or nested domain, depending on the DN of the entry.

nsNumMailLists

Number of mail lists.

TELEPHONE SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Telephone Syntax

DN of Configuration Entry

cn=Telephone Syntax,cn=plugins,cn=config

Description

Syntax for handling telephone numbers.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

UID UNIQUENESS PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

UID Uniqueness

DN of Configuration Entry

cn=UID Uniqueness,cn=plugins,cn=config

Description

Checks that the values of specified attributes are unique each time a modification occurs on an entry.

Configurable Options

on | off

Default Setting

off

Configurable Arguments

You may configure this plug-in in either of two different ways.

1. Specify attributes that must be unique for a series of one or more subtrees identified by DNs. For example, to specify that employeeNumber and uid attribute values must be unique across both o=org1,dc=example,dc=com and o=org2,dc=example,dc=com , configure the arguments in the configuration entry as follows:

   nsslapd-pluginarg0: employeeNumber
   nsslapd-pluginarg1: uid
   nsslapd-pluginarg2: o=org1,dc=example,dc=com
   nsslapd-pluginarg3: o=org2,dc=example,dc=com

2. You specify attributes that must be unique inside congruent subtrees, optionally only on entries of a specified object class. For example, to specify that employeeNumber and uid attribute values must be unique in either o=org1,dc=example,dc=com or o=org2,dc=example,dc=com, but only on entries of the inetOrgPerson object class, configure the arguments in the configuration entry as follows:

   nsslapd-pluginarg0: employeeNumber
   nsslapd-pluginarg1: uid
   nsslapd-pluginarg2: MarkerObjectClass="organization"
    RequiredObjectClass="inetOrgPerson"

Dependencies

database type

Performance Related Information

Directory Server provides the UID Uniqueness plug-in by default. To ensure unique values for other attributes, you can create instances of the UID Uniqueness plug-in for those attributes.

The UID Uniqueness plug-in may slow down Directory Server performance.

URI PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

URI Syntax

DN of Configuration Entry

cn=URI Syntax,cn=plugins,cn=config

Description

Syntax for handling URIs (Unique Resource Identifiers) including URLs (Unique Resource Locators.)

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised June 2010

Name | Description | Attributes | See Also

nsslapd-pluginId(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-plugin, nsslapd-plugin-depends-on-named, nsslapd-plugin-depends-on-type, nsslapd-pluginDescription, nsslapd-pluginEnabled, nsslapd-pluginId, nsslapd-pluginInitfunc, nsslapd-pluginPath, nsslapd-pluginType, nsslapd-pluginVendor, nsslapd-pluginVersion – Directory Server plug-in legacy configuration

Description

The nsslapd-plugin attribute on cn=config is multi-valued, read-only attribute lists the syntaxes and matching rules loaded by the server. This manual page covers server plug-in configuration, rather than the nsslapd-plugin attribute.

This manual page provides an overview of legacy configuration information for server plug-ins. This manual page covers the individual plug-in configuration entry attributes. Also, this manual page covers the plug-ins provided with Directory Server, including configurable options, configurable arguments, default setting, dependencies, general performance related information, and further reading.

---

Note –

In most circumstances, you configure plug-in functionality using the dsconf(1M) command. See plugin(5dsconf) for a list of configurable properties.

---

ATTRIBUTES FOR PLUG-IN CONFIGURATION ENTRIES

The following list covers each plug-in configuration entry attribute.

nsslapd-plugin-depends-on-named

This is a multivalued attribute, used to ensure that plug-ins are called by the server in the correct order. It takes a value that corresponds to the cn value of a plug-in. The plug-in whose cn value matches one of the values below it is started by the server prior to this plug-in. If the plug-in does not exist, the server fails to start.

Entry DN

cn=pluginName,cn=plugins, cn=config

Valid Range

Plug-in name

Default Value

None

Syntax

DirectoryString

Example

nsslapd-plugin-depends-on-named: Class of Service

nsslapd-plugin-depends-on-type

This is a multivalued attribute, used to ensure that plug-ins are called by the server in the correct order. It takes a value that corresponds to the type of a plug-in, contained in the attribute nsslapd-pluginType, and requires that plug-ins of that type are started before the present plug-in.

Entry DN

cn=pluginName,cn=plugins, cn=config

Valid Range

Plug-in type

Default Value

None

Syntax

DirectoryString

Example

nsslapd-plugin-depends-on-type: database

nsslapd-pluginDescription

Provides a description of the plug-in.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any DirectoryString

Default Value

None

Syntax

DirectoryString

Example

nsslapd-pluginDescription: acl access check plug-in

nsslapd-pluginEnabled

Specifies whether or not the plug-in is enabled. This attribute can be changed over protocol, but will only take effect when the server is next restarted.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

on | off

Default Value

on

Syntax

DirectoryString

Example

nsslapd-pluginEnabled: on

nsslapd-pluginId

Specifies the plug-in ID.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any valid plug-in ID.

Default Value

None

Syntax

DirectoryString

Example

nsslapd-pluginId: chaining database

nsslapd-pluginInitfunc

Specifies the plug-in function to be initiated.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any valid plug-in function.

Default Value

None

Syntax

DirectoryString

Example

nsslapd-pluginInitfunc: NS7bitAttr_Init

nsslapd-pluginPath

Specifies the full path to the plug-in.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any valid path

Default Value

None

Syntax

DirectoryString

Example

nsslapd-pluginPath: /opt/SUNWdsee7/lib/sparcv9/uid-plugin.so

nsslapd-pluginType

Specifies the plug-in type.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any valid plug-in type.

Default Value

None

Syntax

DirectoryString

Example

nsslapd-pluginType: preoperation

nsslapd-pluginVendor

Specifies the vendor of the plug-in.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any approved plug-in vendor.

Default Value

Sun Microsystems, Inc.

Syntax

DirectoryString

Example

nsslapd-pluginVendor: Sun Microsystems, Inc.

nsslapd-pluginVersion

Specifies the plug-in version.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any valid plug-in version.

Default Value

Product version

Syntax

DirectoryString

Example

nsslapd-pluginVersion: 11.1.1.3.0

7-BIT CHECK PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

7-Bit Check (NS7bitAttr)

DN of Configuration Entry

cn=7-bit check,cn=plugins,cn=config

Description

Checks certain attributes are seven-bit clean.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

List of attributes, uid mail userpassword, followed by a comma, and then by the suffix or suffixes on which the check is to occur.

Dependencies

None

Performance Related Information

None

Further Information

If your Directory Server uses non-ASCII characters such as Japanese and other languages for some attributes, remove those attributes from the list of attributes checked by this plug-in.

When adding or modifying an attribute value checked by this plug-in, and the new value violates the seven-bit check, the client receives a LDAP_CONSTRAINT_VIOLATION (19) return code, and a message such as the following: Value of attribute attr contains extended (8-bit) characters: value

ACL PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

ACL Plugin

DN of Configuration Entry

cn=ACL Plugin,cn=plugins,cn=config

Description

ACL access check plug-in

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Leave this plug-in running at all times.

ACL PREOPERATION PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

ACL preoperation

DN of Configuration Entry

cn=ACL preoperation,cn=plugins,cn=config

Description

ACL access check plug-in.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

Database

Performance Related Information

Leave this plug-in running at all times.

BINARY SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Binary Syntax

DN of Configuration Entry

cn=Binary Syntax,cn=plugins,cn=config

Description

Syntax for handling binary data.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

BOOLEAN SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Boolean Syntax

DN of Configuration Entry

cn=Boolean Syntax,cn=plugins,cn=config

Description

Syntax for handling booleans.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CASE EXACT STRING SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Case Exact String Syntax

DN of Configuration Entry

cn=Case Exact String Syntax,cn=plugins,cn=config

Description

Syntax for handling case-sensitive strings.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CASE IGNORE STRING SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Case Ignore String Syntax

DN of Configuration Entry

cn=Case Ignore String Syntax,cn=plugins,cn=config

Description

Syntax for handling case-insensitive strings.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CHAINING DATABASE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Chaining Database

DN of Configuration Entry

cn=Chaining database,cn=plugins,cn=config

Description

Syntax for handling DNs.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CLASS OF SERVICE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Class of Service

DN of Configuration Entry

cn=Class of Service,cn=plugins,cn=config

Description

Allows for sharing of attributes between entries.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

Set the nsslapd-pluginarg0 attribute to:

• 0 (default) to enable fast lookup of classic CoS templates

• 1 to disable fast lookup for classic CoS template selection

• 2 to disable checks for ambiguous pointer and classic CoS definitions

  Ambiguous definitions result when more than one value could be returned for the same attribute of the same entry. When checking remains enabled, Directory Server logs an informational message upon encountering such an ambiguity, provided you have set the log level to allow plug-ins to log informational messages.

• 3 to disable both

Restart Directory Server for modifications to take effect.

Dependencies

None

Performance Related Information

Leave this plug-in running at all times.

COUNTRY STRING SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Country String Syntax

DN of Configuration Entry

cn=Country String Syntax,cn=plugins,cn=config

Description

Syntax for handling countries.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

DISTINGUISHED NAME SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Distinguished Name Syntax

DN of Configuration Entry

cn=Distinguished Name Syntax,cn=plugins,cn=config

Description

Syntax for handling DNs.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

DSML FRONTEND SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Frontend

DN of Configuration Entry

cn=DSMLv2-SOAP-HTTP,cn=frontends,cn=plugins, cn=config

Description

Enables you to access the directory using DSML v2 over SOAP/HTTP.

Configurable Options

on | off

Default Setting

off

Configurable Arguments

ds-hdsml-soapschemalocation

ds-hdsml-dsmlschemalocation

Dependencies

None

Performance Related Information

None

GENERALIZED TIME SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Generalized Time Syntax

DN of Configuration Entry

cn=Generalized Time Syntax,cn=plugins,cn=config

Description

Syntax for dealing with dates, times, and time zones.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

Further Information

The Generalized Time String consists of the four digit year, two digit month (for example, 01 for January), two digit day, two digit hour, two digit minute, two digit second, an optional decimal part of a second and a time zone indication. We strongly recommend that you use the Z time zone indication (Greenwich Mean Time).

INTEGER SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Integer Syntax

DN of Configuration Entry

cn=Integer Syntax,cn=plugins,cn=config

Description

Syntax for handling integers.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

INTERNATIONALIZATION PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Internationalization Plugin

DN of Configuration Entry

cn=Internationalization Plugin,cn=plugins,cn=config

Description

Syntax for handling DNs.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None. In contrast to previous versions of Directory Server, the collation orders and locales used by the internationalization plug-in are now stored in the configuration.

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

LDBM DATABASE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

ldbm database plug-in

DN of Configuration Entry

cn=ldbm database plug-in,cn=plugins,cn=config

Description

Implements local databases.

Configurable Options

None

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Leave this plug-in running at all times.

MULTIMASTER REPLICATION PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Multimaster Replication Plugin

DN of Configuration Entry

cn=Multimaster Replication plugin,cn=plugins, cn=config

Description

Enables replication between two Directory Server suffixes.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

database

Performance Related Information

None

Further Information

You can turn this plug-in off if you have only one server, which will never replicate.

OCTET STRING SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Octet String Syntax

DN of Configuration Entry

cn=Octet String Syntax,cn=plugins,cn=config

Description

Syntax for handling octet strings.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CLEAR PASSWORD STORAGE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

CLEAR

DN of Configuration Entry

cn=CLEAR,cn=Password Storage Schemes,cn=plugins, cn=config

Description

CLEAR password storage scheme used for password encryption.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CRYPT PASSWORD STORAGE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

CRYPT

DN of Configuration Entry

cn=CRYPT,cn=Password Storage Schemes,cn=plugins, cn=config

Description

CRYPT password storage scheme used for password encryption.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

NS-MTA-MD5 PASSWORD STORAGE SCHEME PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

NS-MTA-MD5

DN of Configuration Entry

cn=NS-MTA-MD5,cn=Password Storage Schemes, cn=plugins,cn=config

Description

NS-MTA-MD5 password storage scheme for password encryption.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

Further Information

You can no longer choose to encrypt passwords using the NS-MTA-MD5 password storage scheme. The storage scheme is still present, but for backward compatibility only. The data in your directory still contains passwords encrypted with the NS-MTA-MD5 password storage scheme.

RMCE PASSWORD STORAGE SCHEME PLUG-IN

This password storage scheme plug-in is used for example by the administration framework and is reserved for internal use.

SHA PASSWORD STORAGE SCHEME PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

SHA

DN of Configuration Entry

cn=SHA,cn=Password Storage Schemes,cn=plugins, cn=config

Description

SHA password storage scheme for password encryption.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

If there are no passwords encrypted using the SHA password storage scheme, you may turn this plug-in off. If you want to encrypt your password with the SHA password storage scheme, choose SSHA instead. SSHA is a far more secure option.

SSHA PASSWORD STORAGE SCHEME PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

SSHA

DN of Configuration Entry

cn=SSHA,cn=Password Storage Schemes,cn=plugins, cn=config

Description

SSHA password storage scheme for password encryption.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

STRONG PASSWORD CHECK PLUG-IN

When Directory Server is configured to check password quality, and this plug-in is enabled, the plug-in checks the following each time a password is added or modified.

• Clear text password values contain the classes of characters specified by the configuration.

• Clear text password values do not contain any sequence of four characters present in the dictionary file specified by the configuration.

Hashed password values such as {SSHA}0Ri1g2yqlH3GTZcuRQ4uS22syCQLBKAU2ypLSw== are not checked.

Consider the following aspects of this plug-in.

Plug-In Name

Strong Password Checking plug-in

DN of Configuration Entry

cn=Strong Password Check,cn=plugins,cn=config

Configurable options and arguments

on | off

nsslapd-pluginarg0, which takes an integer representing a mask of values representing the character classes that must be present in a valid password. Set nsslapd-pluginarg0 to one of or a sum of the following values, not counting the special values 16 and 17.

• 1 means the password must contain special characters.

• 2 means the password must contain numeric characters.

• 4 means the password must contain upper case characters.

• 8 means the password must contain lower case characters.

• 16 is a special value meaning at least three of the four character classes.

• 17 is a special value meaning at least two of the four character classes.

The default setting is 15.

nsslapd-pluginarg1, which takes the absolute file system path to an ASCII dictionary file. If the argument is missing, the dictionary check is skipped. The plug-in does not initialize and Directory Server does not start if the value of this attribute is invalid or refers to an inaccessible file.

Default settings

off

Dependencies

Default password file, install-path/resources/plugins/words-english-big.txt

POSTAL ADDRESS STRING SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Postal Address Syntax

DN of Configuration Entry

cn=Postal Address Syntax,cn=plugins,cn=config

Description

Syntax used for handling postal addresses.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

PTA PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Pass Through Authentication

DN of Configuration Entry

cn=Pass Through Authentication,cn=plugins, cn=config

Description

Enables pass-through authentication, the mechanism that allows one directory to consult another to authenticate bind requests.

Configurable Options

on | off

Default Setting

off

Configurable Arguments

The LDAP URL to the configuration directory.

nsslapd-pluginarg0: ldap://config.example.com/o=example

Dependencies

None

REFERENTIAL INTEGRITY POSTOPERATION PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Referential Integrity Postoperation

DN of Configuration Entry

cn=Referential Integrity Postoperation, cn=plugins,cn=config

Description

Enables the server to ensure referential integrity.

All attributes in all databases that are used by the referential integrity plug-in must be indexed. The indexes need to be created in the configuration of all the databases. When the retro change log is enabled, the cn=changelog suffix must be indexed.

Configurable Options

All configuration and on | off

Default Setting

off

Configurable Arguments

When enabled, the post operation Referential Integrity plug-in performs integrity updates on the member, uniquemember, owner, and seeAlso attributes immediately after a delete or rename operation. You can reconfigure the plug-in to perform integrity checks on all other attributes.

The following arguments are configurable:

1. (nsslapd-pluginarg0) Check for referential integrity

   -1 = no check for referential integrity

   0 = check for referential integrity is performed immediately

   positive integer = request for referential integrity is queued and processed at a later stage. This positive integer serves as a wake-up call for the thread to process the request, at intervals corresponding to the integer specified.

2. (nsslapd-pluginarg1) Log file for storing the change, for example /local/dsInst/logs/referint

3. (nsslapd-pluginarg2) Reserved for future use.

4. (Other nsslapd-pluginarg* attributes) Attribute names to be checked for referential integrity.

Dependencies

database type

Tuning Recommendations

Do the following when you use the referential integrity plug-in in a multi-master replication environment:

• Enable the referential integrity plug-in on all servers containing master replicas

• Enable the referential integrity plug-in with the same configuration on every master

Set the first argument to a positive value, such as 10, meaning ten seconds, to ensure that work performed by this plug-in happens asynchronously, rather than synchronously.

When enabling the plug-in, also create equality indexes for all attributes configured for use with the plug-in. The plug-in uses such indexes when searching for entries to update. Without equality indexes for the attributes it uses, the plug-in must perform costly unindexed searches that have negative impact on performance.

RETRO CHANGE LOG PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Retro Changelog Plugin

DN of Configuration Entry

cn=Retro Changelog Plugin,cn=plugins,cn=config

Description

Used by LDAP clients for maintaining application compatibility with Directory Server 4.x versions.

Maintains a log of all changes occurring in Directory Server. The retro change log offers the same functionality as the changelog in the 4.x versions of Directory Server.

Configurable Options

on | off

Default Setting

off

Configurable Arguments

The following arguments can be configured for the retro change log plug-in:

• nsslapd-pluginarg0: -ignore_attributesconfigures the retro change log plug-in to ignore attributes specified by the following nsslapd-pluginarg. This argument is configured by default.

• nsslapd-pluginarg1: copyingFromspecifies a list of attributes to be ignored by the preceding nsslapd-pluginarg. This argument is configured by default.

• nsslapd-pluginarg2: suffixes="suffix1","suffix2" configures the retro change log to record updates to specified suffixes only

• nsslapd-pluginarg3: deletedEntryAttributes=attribute1,attribute2 configures the retro change log to record specified attributes of an entry when that entry is deleted

Dependencies

None

Performance Related Information

May slow down Directory Server performance.

Example Configuration

dn: cn=Retro Changelog Plugin,cn=plugins,cn=config
objectClass: top
objectClass: nsSlapdPlugin
objectClass: ds-signedPlugin
objectClass: extensibleObject
cn: Retro Changelog Plugin
nsslapd-pluginPath: /opt/SUNWdsee7/lib/sparcv9/retrocl-plugin.so
nsslapd-pluginInitfunc: retrocl_plugin_init
nsslapd-pluginType: object
nsslapd-plugin-depends-on-type: database
nsslapd-pluginarg0: -ignore_attributes
nsslapd-pluginarg1: copyingFrom
nsslapd-pluginarg2: suffixes="ou=people","dc=example","dc=com"
nsslapd-pluginarg3: deletedEntryAtrributes="objectclass","employeenumber"
nsslapd-changelogdir: /local/dsInst/db/changelog
nsslapd-pluginEnabled: on
nsslapd-pluginId: retrocl
nsslapd-pluginVersion: 11.1.1.3.0
nsslapd-pluginVendor: Sun Microsystems, Inc.
nsslapd-pluginDescription: Retrocl Plugin
ds-pluginSignatureState: valid signature

ROLES PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Roles Plugin

DN of Configuration Entry

cn=Roles Plugin,cn=plugins,cn=config

Description

Enables the use of roles in Directory Server.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

State Change Plugin

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

STATE CHANGE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

State Change Plugin

DN of Configuration Entry

cn=State Change Plugin,cn=plugins,cn=config

Description

State change notification service plug-in for detecting updates, such as configuration changes, and triggering callbacks when updates happen.

This plug-in is used internally by the roles plug-in.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

SUBTREE ENTRY COUNTER PLUG-INS

Consider the following aspects of this plug-in.

Plug-In Name

Subtree Entry Counter For ObjectClass

DN of Configuration Entry

cn=Subtree Entry Counter for ObjectClass,cn=plugins, cn=config

Description

Maintain a count of entries with a particular object class. The following plug-ins are provided.

• Subtree entry counter for departments in domains

• Subtree entry counter for domains within a domain

• Subtree entry counter for mail lists

• Subtree entry counter for nested departments

• Subtree entry counter for total domains

• Subtree entry counter for users

Configurable Options

on | off

Default Setting

off

Configurable Arguments

None

Dependencies

None

Performance Related Information

These plug-ins are provided for use with Messaging Server only, and are disabled by default. Leave these plug-ins disabled unless your Messaging Server requires them.

Counter Attributes Maintained

nsNumDepts

Either the number of departments within a domain, or the number of departments within a department (nested departments), depending on the DN of the entry.

nsNumDomains

Either the number of total domains, or the number of domains within a domain or nested domain, depending on the DN of the entry.

nsNumMailLists

Number of mail lists.

TELEPHONE SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Telephone Syntax

DN of Configuration Entry

cn=Telephone Syntax,cn=plugins,cn=config

Description

Syntax for handling telephone numbers.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

UID UNIQUENESS PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

UID Uniqueness

DN of Configuration Entry

cn=UID Uniqueness,cn=plugins,cn=config

Description

Checks that the values of specified attributes are unique each time a modification occurs on an entry.

Configurable Options

on | off

Default Setting

off

Configurable Arguments

You may configure this plug-in in either of two different ways.

1. Specify attributes that must be unique for a series of one or more subtrees identified by DNs. For example, to specify that employeeNumber and uid attribute values must be unique across both o=org1,dc=example,dc=com and o=org2,dc=example,dc=com , configure the arguments in the configuration entry as follows:

   nsslapd-pluginarg0: employeeNumber
   nsslapd-pluginarg1: uid
   nsslapd-pluginarg2: o=org1,dc=example,dc=com
   nsslapd-pluginarg3: o=org2,dc=example,dc=com

2. You specify attributes that must be unique inside congruent subtrees, optionally only on entries of a specified object class. For example, to specify that employeeNumber and uid attribute values must be unique in either o=org1,dc=example,dc=com or o=org2,dc=example,dc=com, but only on entries of the inetOrgPerson object class, configure the arguments in the configuration entry as follows:

   nsslapd-pluginarg0: employeeNumber
   nsslapd-pluginarg1: uid
   nsslapd-pluginarg2: MarkerObjectClass="organization"
    RequiredObjectClass="inetOrgPerson"

Dependencies

database type

Performance Related Information

Directory Server provides the UID Uniqueness plug-in by default. To ensure unique values for other attributes, you can create instances of the UID Uniqueness plug-in for those attributes.

The UID Uniqueness plug-in may slow down Directory Server performance.

URI PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

URI Syntax

DN of Configuration Entry

cn=URI Syntax,cn=plugins,cn=config

Description

Syntax for handling URIs (Unique Resource Identifiers) including URLs (Unique Resource Locators.)

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised June 2010

Name | Description | Attributes | See Also

nsslapd-pluginInitfunc(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-plugin, nsslapd-plugin-depends-on-named, nsslapd-plugin-depends-on-type, nsslapd-pluginDescription, nsslapd-pluginEnabled, nsslapd-pluginId, nsslapd-pluginInitfunc, nsslapd-pluginPath, nsslapd-pluginType, nsslapd-pluginVendor, nsslapd-pluginVersion – Directory Server plug-in legacy configuration

Description

The nsslapd-plugin attribute on cn=config is multi-valued, read-only attribute lists the syntaxes and matching rules loaded by the server. This manual page covers server plug-in configuration, rather than the nsslapd-plugin attribute.

This manual page provides an overview of legacy configuration information for server plug-ins. This manual page covers the individual plug-in configuration entry attributes. Also, this manual page covers the plug-ins provided with Directory Server, including configurable options, configurable arguments, default setting, dependencies, general performance related information, and further reading.

---

Note –

In most circumstances, you configure plug-in functionality using the dsconf(1M) command. See plugin(5dsconf) for a list of configurable properties.

---

ATTRIBUTES FOR PLUG-IN CONFIGURATION ENTRIES

The following list covers each plug-in configuration entry attribute.

nsslapd-plugin-depends-on-named

This is a multivalued attribute, used to ensure that plug-ins are called by the server in the correct order. It takes a value that corresponds to the cn value of a plug-in. The plug-in whose cn value matches one of the values below it is started by the server prior to this plug-in. If the plug-in does not exist, the server fails to start.

Entry DN

cn=pluginName,cn=plugins, cn=config

Valid Range

Plug-in name

Default Value

None

Syntax

DirectoryString

Example

nsslapd-plugin-depends-on-named: Class of Service

nsslapd-plugin-depends-on-type

This is a multivalued attribute, used to ensure that plug-ins are called by the server in the correct order. It takes a value that corresponds to the type of a plug-in, contained in the attribute nsslapd-pluginType, and requires that plug-ins of that type are started before the present plug-in.

Entry DN

cn=pluginName,cn=plugins, cn=config

Valid Range

Plug-in type

Default Value

None

Syntax

DirectoryString

Example

nsslapd-plugin-depends-on-type: database

nsslapd-pluginDescription

Provides a description of the plug-in.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any DirectoryString

Default Value

None

Syntax

DirectoryString

Example

nsslapd-pluginDescription: acl access check plug-in

nsslapd-pluginEnabled

Specifies whether or not the plug-in is enabled. This attribute can be changed over protocol, but will only take effect when the server is next restarted.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

on | off

Default Value

on

Syntax

DirectoryString

Example

nsslapd-pluginEnabled: on

nsslapd-pluginId

Specifies the plug-in ID.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any valid plug-in ID.

Default Value

None

Syntax

DirectoryString

Example

nsslapd-pluginId: chaining database

nsslapd-pluginInitfunc

Specifies the plug-in function to be initiated.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any valid plug-in function.

Default Value

None

Syntax

DirectoryString

Example

nsslapd-pluginInitfunc: NS7bitAttr_Init

nsslapd-pluginPath

Specifies the full path to the plug-in.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any valid path

Default Value

None

Syntax

DirectoryString

Example

nsslapd-pluginPath: /opt/SUNWdsee7/lib/sparcv9/uid-plugin.so

nsslapd-pluginType

Specifies the plug-in type.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any valid plug-in type.

Default Value

None

Syntax

DirectoryString

Example

nsslapd-pluginType: preoperation

nsslapd-pluginVendor

Specifies the vendor of the plug-in.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any approved plug-in vendor.

Default Value

Sun Microsystems, Inc.

Syntax

DirectoryString

Example

nsslapd-pluginVendor: Sun Microsystems, Inc.

nsslapd-pluginVersion

Specifies the plug-in version.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any valid plug-in version.

Default Value

Product version

Syntax

DirectoryString

Example

nsslapd-pluginVersion: 11.1.1.3.0

7-BIT CHECK PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

7-Bit Check (NS7bitAttr)

DN of Configuration Entry

cn=7-bit check,cn=plugins,cn=config

Description

Checks certain attributes are seven-bit clean.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

List of attributes, uid mail userpassword, followed by a comma, and then by the suffix or suffixes on which the check is to occur.

Dependencies

None

Performance Related Information

None

Further Information

If your Directory Server uses non-ASCII characters such as Japanese and other languages for some attributes, remove those attributes from the list of attributes checked by this plug-in.

When adding or modifying an attribute value checked by this plug-in, and the new value violates the seven-bit check, the client receives a LDAP_CONSTRAINT_VIOLATION (19) return code, and a message such as the following: Value of attribute attr contains extended (8-bit) characters: value

ACL PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

ACL Plugin

DN of Configuration Entry

cn=ACL Plugin,cn=plugins,cn=config

Description

ACL access check plug-in

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Leave this plug-in running at all times.

ACL PREOPERATION PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

ACL preoperation

DN of Configuration Entry

cn=ACL preoperation,cn=plugins,cn=config

Description

ACL access check plug-in.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

Database

Performance Related Information

Leave this plug-in running at all times.

BINARY SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Binary Syntax

DN of Configuration Entry

cn=Binary Syntax,cn=plugins,cn=config

Description

Syntax for handling binary data.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

BOOLEAN SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Boolean Syntax

DN of Configuration Entry

cn=Boolean Syntax,cn=plugins,cn=config

Description

Syntax for handling booleans.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CASE EXACT STRING SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Case Exact String Syntax

DN of Configuration Entry

cn=Case Exact String Syntax,cn=plugins,cn=config

Description

Syntax for handling case-sensitive strings.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CASE IGNORE STRING SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Case Ignore String Syntax

DN of Configuration Entry

cn=Case Ignore String Syntax,cn=plugins,cn=config

Description

Syntax for handling case-insensitive strings.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CHAINING DATABASE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Chaining Database

DN of Configuration Entry

cn=Chaining database,cn=plugins,cn=config

Description

Syntax for handling DNs.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CLASS OF SERVICE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Class of Service

DN of Configuration Entry

cn=Class of Service,cn=plugins,cn=config

Description

Allows for sharing of attributes between entries.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

Set the nsslapd-pluginarg0 attribute to:

• 0 (default) to enable fast lookup of classic CoS templates

• 1 to disable fast lookup for classic CoS template selection

• 2 to disable checks for ambiguous pointer and classic CoS definitions

  Ambiguous definitions result when more than one value could be returned for the same attribute of the same entry. When checking remains enabled, Directory Server logs an informational message upon encountering such an ambiguity, provided you have set the log level to allow plug-ins to log informational messages.

• 3 to disable both

Restart Directory Server for modifications to take effect.

Dependencies

None

Performance Related Information

Leave this plug-in running at all times.

COUNTRY STRING SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Country String Syntax

DN of Configuration Entry

cn=Country String Syntax,cn=plugins,cn=config

Description

Syntax for handling countries.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

DISTINGUISHED NAME SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Distinguished Name Syntax

DN of Configuration Entry

cn=Distinguished Name Syntax,cn=plugins,cn=config

Description

Syntax for handling DNs.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

DSML FRONTEND SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Frontend

DN of Configuration Entry

cn=DSMLv2-SOAP-HTTP,cn=frontends,cn=plugins, cn=config

Description

Enables you to access the directory using DSML v2 over SOAP/HTTP.

Configurable Options

on | off

Default Setting

off

Configurable Arguments

ds-hdsml-soapschemalocation

ds-hdsml-dsmlschemalocation

Dependencies

None

Performance Related Information

None

GENERALIZED TIME SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Generalized Time Syntax

DN of Configuration Entry

cn=Generalized Time Syntax,cn=plugins,cn=config

Description

Syntax for dealing with dates, times, and time zones.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

Further Information

The Generalized Time String consists of the four digit year, two digit month (for example, 01 for January), two digit day, two digit hour, two digit minute, two digit second, an optional decimal part of a second and a time zone indication. We strongly recommend that you use the Z time zone indication (Greenwich Mean Time).

INTEGER SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Integer Syntax

DN of Configuration Entry

cn=Integer Syntax,cn=plugins,cn=config

Description

Syntax for handling integers.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

INTERNATIONALIZATION PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Internationalization Plugin

DN of Configuration Entry

cn=Internationalization Plugin,cn=plugins,cn=config

Description

Syntax for handling DNs.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None. In contrast to previous versions of Directory Server, the collation orders and locales used by the internationalization plug-in are now stored in the configuration.

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

LDBM DATABASE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

ldbm database plug-in

DN of Configuration Entry

cn=ldbm database plug-in,cn=plugins,cn=config

Description

Implements local databases.

Configurable Options

None

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Leave this plug-in running at all times.

MULTIMASTER REPLICATION PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Multimaster Replication Plugin

DN of Configuration Entry

cn=Multimaster Replication plugin,cn=plugins, cn=config

Description

Enables replication between two Directory Server suffixes.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

database

Performance Related Information

None

Further Information

You can turn this plug-in off if you have only one server, which will never replicate.

OCTET STRING SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Octet String Syntax

DN of Configuration Entry

cn=Octet String Syntax,cn=plugins,cn=config

Description

Syntax for handling octet strings.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CLEAR PASSWORD STORAGE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

CLEAR

DN of Configuration Entry

cn=CLEAR,cn=Password Storage Schemes,cn=plugins, cn=config

Description

CLEAR password storage scheme used for password encryption.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CRYPT PASSWORD STORAGE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

CRYPT

DN of Configuration Entry

cn=CRYPT,cn=Password Storage Schemes,cn=plugins, cn=config

Description

CRYPT password storage scheme used for password encryption.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

NS-MTA-MD5 PASSWORD STORAGE SCHEME PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

NS-MTA-MD5

DN of Configuration Entry

cn=NS-MTA-MD5,cn=Password Storage Schemes, cn=plugins,cn=config

Description

NS-MTA-MD5 password storage scheme for password encryption.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

Further Information

You can no longer choose to encrypt passwords using the NS-MTA-MD5 password storage scheme. The storage scheme is still present, but for backward compatibility only. The data in your directory still contains passwords encrypted with the NS-MTA-MD5 password storage scheme.

RMCE PASSWORD STORAGE SCHEME PLUG-IN

This password storage scheme plug-in is used for example by the administration framework and is reserved for internal use.

SHA PASSWORD STORAGE SCHEME PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

SHA

DN of Configuration Entry

cn=SHA,cn=Password Storage Schemes,cn=plugins, cn=config

Description

SHA password storage scheme for password encryption.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

If there are no passwords encrypted using the SHA password storage scheme, you may turn this plug-in off. If you want to encrypt your password with the SHA password storage scheme, choose SSHA instead. SSHA is a far more secure option.

SSHA PASSWORD STORAGE SCHEME PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

SSHA

DN of Configuration Entry

cn=SSHA,cn=Password Storage Schemes,cn=plugins, cn=config

Description

SSHA password storage scheme for password encryption.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

STRONG PASSWORD CHECK PLUG-IN

When Directory Server is configured to check password quality, and this plug-in is enabled, the plug-in checks the following each time a password is added or modified.

• Clear text password values contain the classes of characters specified by the configuration.

• Clear text password values do not contain any sequence of four characters present in the dictionary file specified by the configuration.

Hashed password values such as {SSHA}0Ri1g2yqlH3GTZcuRQ4uS22syCQLBKAU2ypLSw== are not checked.

Consider the following aspects of this plug-in.

Plug-In Name

Strong Password Checking plug-in

DN of Configuration Entry

cn=Strong Password Check,cn=plugins,cn=config

Configurable options and arguments

on | off

nsslapd-pluginarg0, which takes an integer representing a mask of values representing the character classes that must be present in a valid password. Set nsslapd-pluginarg0 to one of or a sum of the following values, not counting the special values 16 and 17.

• 1 means the password must contain special characters.

• 2 means the password must contain numeric characters.

• 4 means the password must contain upper case characters.

• 8 means the password must contain lower case characters.

• 16 is a special value meaning at least three of the four character classes.

• 17 is a special value meaning at least two of the four character classes.

The default setting is 15.

nsslapd-pluginarg1, which takes the absolute file system path to an ASCII dictionary file. If the argument is missing, the dictionary check is skipped. The plug-in does not initialize and Directory Server does not start if the value of this attribute is invalid or refers to an inaccessible file.

Default settings

off

Dependencies

Default password file, install-path/resources/plugins/words-english-big.txt

POSTAL ADDRESS STRING SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Postal Address Syntax

DN of Configuration Entry

cn=Postal Address Syntax,cn=plugins,cn=config

Description

Syntax used for handling postal addresses.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

PTA PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Pass Through Authentication

DN of Configuration Entry

cn=Pass Through Authentication,cn=plugins, cn=config

Description

Enables pass-through authentication, the mechanism that allows one directory to consult another to authenticate bind requests.

Configurable Options

on | off

Default Setting

off

Configurable Arguments

The LDAP URL to the configuration directory.

nsslapd-pluginarg0: ldap://config.example.com/o=example

Dependencies

None

REFERENTIAL INTEGRITY POSTOPERATION PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Referential Integrity Postoperation

DN of Configuration Entry

cn=Referential Integrity Postoperation, cn=plugins,cn=config

Description

Enables the server to ensure referential integrity.

All attributes in all databases that are used by the referential integrity plug-in must be indexed. The indexes need to be created in the configuration of all the databases. When the retro change log is enabled, the cn=changelog suffix must be indexed.

Configurable Options

All configuration and on | off

Default Setting

off

Configurable Arguments

When enabled, the post operation Referential Integrity plug-in performs integrity updates on the member, uniquemember, owner, and seeAlso attributes immediately after a delete or rename operation. You can reconfigure the plug-in to perform integrity checks on all other attributes.

The following arguments are configurable:

1. (nsslapd-pluginarg0) Check for referential integrity

   -1 = no check for referential integrity

   0 = check for referential integrity is performed immediately

   positive integer = request for referential integrity is queued and processed at a later stage. This positive integer serves as a wake-up call for the thread to process the request, at intervals corresponding to the integer specified.

2. (nsslapd-pluginarg1) Log file for storing the change, for example /local/dsInst/logs/referint

3. (nsslapd-pluginarg2) Reserved for future use.

4. (Other nsslapd-pluginarg* attributes) Attribute names to be checked for referential integrity.

Dependencies

database type

Tuning Recommendations

Do the following when you use the referential integrity plug-in in a multi-master replication environment:

• Enable the referential integrity plug-in on all servers containing master replicas

• Enable the referential integrity plug-in with the same configuration on every master

Set the first argument to a positive value, such as 10, meaning ten seconds, to ensure that work performed by this plug-in happens asynchronously, rather than synchronously.

When enabling the plug-in, also create equality indexes for all attributes configured for use with the plug-in. The plug-in uses such indexes when searching for entries to update. Without equality indexes for the attributes it uses, the plug-in must perform costly unindexed searches that have negative impact on performance.

RETRO CHANGE LOG PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Retro Changelog Plugin

DN of Configuration Entry

cn=Retro Changelog Plugin,cn=plugins,cn=config

Description

Used by LDAP clients for maintaining application compatibility with Directory Server 4.x versions.

Maintains a log of all changes occurring in Directory Server. The retro change log offers the same functionality as the changelog in the 4.x versions of Directory Server.

Configurable Options

on | off

Default Setting

off

Configurable Arguments

The following arguments can be configured for the retro change log plug-in:

• nsslapd-pluginarg0: -ignore_attributesconfigures the retro change log plug-in to ignore attributes specified by the following nsslapd-pluginarg. This argument is configured by default.

• nsslapd-pluginarg1: copyingFromspecifies a list of attributes to be ignored by the preceding nsslapd-pluginarg. This argument is configured by default.

• nsslapd-pluginarg2: suffixes="suffix1","suffix2" configures the retro change log to record updates to specified suffixes only

• nsslapd-pluginarg3: deletedEntryAttributes=attribute1,attribute2 configures the retro change log to record specified attributes of an entry when that entry is deleted

Dependencies

None

Performance Related Information

May slow down Directory Server performance.

Example Configuration

dn: cn=Retro Changelog Plugin,cn=plugins,cn=config
objectClass: top
objectClass: nsSlapdPlugin
objectClass: ds-signedPlugin
objectClass: extensibleObject
cn: Retro Changelog Plugin
nsslapd-pluginPath: /opt/SUNWdsee7/lib/sparcv9/retrocl-plugin.so
nsslapd-pluginInitfunc: retrocl_plugin_init
nsslapd-pluginType: object
nsslapd-plugin-depends-on-type: database
nsslapd-pluginarg0: -ignore_attributes
nsslapd-pluginarg1: copyingFrom
nsslapd-pluginarg2: suffixes="ou=people","dc=example","dc=com"
nsslapd-pluginarg3: deletedEntryAtrributes="objectclass","employeenumber"
nsslapd-changelogdir: /local/dsInst/db/changelog
nsslapd-pluginEnabled: on
nsslapd-pluginId: retrocl
nsslapd-pluginVersion: 11.1.1.3.0
nsslapd-pluginVendor: Sun Microsystems, Inc.
nsslapd-pluginDescription: Retrocl Plugin
ds-pluginSignatureState: valid signature

ROLES PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Roles Plugin

DN of Configuration Entry

cn=Roles Plugin,cn=plugins,cn=config

Description

Enables the use of roles in Directory Server.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

State Change Plugin

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

STATE CHANGE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

State Change Plugin

DN of Configuration Entry

cn=State Change Plugin,cn=plugins,cn=config

Description

State change notification service plug-in for detecting updates, such as configuration changes, and triggering callbacks when updates happen.

This plug-in is used internally by the roles plug-in.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

SUBTREE ENTRY COUNTER PLUG-INS

Consider the following aspects of this plug-in.

Plug-In Name

Subtree Entry Counter For ObjectClass

DN of Configuration Entry

cn=Subtree Entry Counter for ObjectClass,cn=plugins, cn=config

Description

Maintain a count of entries with a particular object class. The following plug-ins are provided.

• Subtree entry counter for departments in domains

• Subtree entry counter for domains within a domain

• Subtree entry counter for mail lists

• Subtree entry counter for nested departments

• Subtree entry counter for total domains

• Subtree entry counter for users

Configurable Options

on | off

Default Setting

off

Configurable Arguments

None

Dependencies

None

Performance Related Information

These plug-ins are provided for use with Messaging Server only, and are disabled by default. Leave these plug-ins disabled unless your Messaging Server requires them.

Counter Attributes Maintained

nsNumDepts

Either the number of departments within a domain, or the number of departments within a department (nested departments), depending on the DN of the entry.

nsNumDomains

Either the number of total domains, or the number of domains within a domain or nested domain, depending on the DN of the entry.

nsNumMailLists

Number of mail lists.

TELEPHONE SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Telephone Syntax

DN of Configuration Entry

cn=Telephone Syntax,cn=plugins,cn=config

Description

Syntax for handling telephone numbers.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

UID UNIQUENESS PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

UID Uniqueness

DN of Configuration Entry

cn=UID Uniqueness,cn=plugins,cn=config

Description

Checks that the values of specified attributes are unique each time a modification occurs on an entry.

Configurable Options

on | off

Default Setting

off

Configurable Arguments

You may configure this plug-in in either of two different ways.

1. Specify attributes that must be unique for a series of one or more subtrees identified by DNs. For example, to specify that employeeNumber and uid attribute values must be unique across both o=org1,dc=example,dc=com and o=org2,dc=example,dc=com , configure the arguments in the configuration entry as follows:

   nsslapd-pluginarg0: employeeNumber
   nsslapd-pluginarg1: uid
   nsslapd-pluginarg2: o=org1,dc=example,dc=com
   nsslapd-pluginarg3: o=org2,dc=example,dc=com

2. You specify attributes that must be unique inside congruent subtrees, optionally only on entries of a specified object class. For example, to specify that employeeNumber and uid attribute values must be unique in either o=org1,dc=example,dc=com or o=org2,dc=example,dc=com, but only on entries of the inetOrgPerson object class, configure the arguments in the configuration entry as follows:

   nsslapd-pluginarg0: employeeNumber
   nsslapd-pluginarg1: uid
   nsslapd-pluginarg2: MarkerObjectClass="organization"
    RequiredObjectClass="inetOrgPerson"

Dependencies

database type

Performance Related Information

Directory Server provides the UID Uniqueness plug-in by default. To ensure unique values for other attributes, you can create instances of the UID Uniqueness plug-in for those attributes.

The UID Uniqueness plug-in may slow down Directory Server performance.

URI PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

URI Syntax

DN of Configuration Entry

cn=URI Syntax,cn=plugins,cn=config

Description

Syntax for handling URIs (Unique Resource Identifiers) including URLs (Unique Resource Locators.)

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised June 2010

Name | Description | Attributes | See Also

nsslapd-pluginPath(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-plugin, nsslapd-plugin-depends-on-named, nsslapd-plugin-depends-on-type, nsslapd-pluginDescription, nsslapd-pluginEnabled, nsslapd-pluginId, nsslapd-pluginInitfunc, nsslapd-pluginPath, nsslapd-pluginType, nsslapd-pluginVendor, nsslapd-pluginVersion – Directory Server plug-in legacy configuration

Description

The nsslapd-plugin attribute on cn=config is multi-valued, read-only attribute lists the syntaxes and matching rules loaded by the server. This manual page covers server plug-in configuration, rather than the nsslapd-plugin attribute.

This manual page provides an overview of legacy configuration information for server plug-ins. This manual page covers the individual plug-in configuration entry attributes. Also, this manual page covers the plug-ins provided with Directory Server, including configurable options, configurable arguments, default setting, dependencies, general performance related information, and further reading.

---

Note –

In most circumstances, you configure plug-in functionality using the dsconf(1M) command. See plugin(5dsconf) for a list of configurable properties.

---

ATTRIBUTES FOR PLUG-IN CONFIGURATION ENTRIES

The following list covers each plug-in configuration entry attribute.

nsslapd-plugin-depends-on-named

This is a multivalued attribute, used to ensure that plug-ins are called by the server in the correct order. It takes a value that corresponds to the cn value of a plug-in. The plug-in whose cn value matches one of the values below it is started by the server prior to this plug-in. If the plug-in does not exist, the server fails to start.

Entry DN

cn=pluginName,cn=plugins, cn=config

Valid Range

Plug-in name

Default Value

None

Syntax

DirectoryString

Example

nsslapd-plugin-depends-on-named: Class of Service

nsslapd-plugin-depends-on-type

This is a multivalued attribute, used to ensure that plug-ins are called by the server in the correct order. It takes a value that corresponds to the type of a plug-in, contained in the attribute nsslapd-pluginType, and requires that plug-ins of that type are started before the present plug-in.

Entry DN

cn=pluginName,cn=plugins, cn=config

Valid Range

Plug-in type

Default Value

None

Syntax

DirectoryString

Example

nsslapd-plugin-depends-on-type: database

nsslapd-pluginDescription

Provides a description of the plug-in.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any DirectoryString

Default Value

None

Syntax

DirectoryString

Example

nsslapd-pluginDescription: acl access check plug-in

nsslapd-pluginEnabled

Specifies whether or not the plug-in is enabled. This attribute can be changed over protocol, but will only take effect when the server is next restarted.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

on | off

Default Value

on

Syntax

DirectoryString

Example

nsslapd-pluginEnabled: on

nsslapd-pluginId

Specifies the plug-in ID.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any valid plug-in ID.

Default Value

None

Syntax

DirectoryString

Example

nsslapd-pluginId: chaining database

nsslapd-pluginInitfunc

Specifies the plug-in function to be initiated.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any valid plug-in function.

Default Value

None

Syntax

DirectoryString

Example

nsslapd-pluginInitfunc: NS7bitAttr_Init

nsslapd-pluginPath

Specifies the full path to the plug-in.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any valid path

Default Value

None

Syntax

DirectoryString

Example

nsslapd-pluginPath: /opt/SUNWdsee7/lib/sparcv9/uid-plugin.so

nsslapd-pluginType

Specifies the plug-in type.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any valid plug-in type.

Default Value

None

Syntax

DirectoryString

Example

nsslapd-pluginType: preoperation

nsslapd-pluginVendor

Specifies the vendor of the plug-in.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any approved plug-in vendor.

Default Value

Sun Microsystems, Inc.

Syntax

DirectoryString

Example

nsslapd-pluginVendor: Sun Microsystems, Inc.

nsslapd-pluginVersion

Specifies the plug-in version.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any valid plug-in version.

Default Value

Product version

Syntax

DirectoryString

Example

nsslapd-pluginVersion: 11.1.1.3.0

7-BIT CHECK PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

7-Bit Check (NS7bitAttr)

DN of Configuration Entry

cn=7-bit check,cn=plugins,cn=config

Description

Checks certain attributes are seven-bit clean.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

List of attributes, uid mail userpassword, followed by a comma, and then by the suffix or suffixes on which the check is to occur.

Dependencies

None

Performance Related Information

None

Further Information

If your Directory Server uses non-ASCII characters such as Japanese and other languages for some attributes, remove those attributes from the list of attributes checked by this plug-in.

When adding or modifying an attribute value checked by this plug-in, and the new value violates the seven-bit check, the client receives a LDAP_CONSTRAINT_VIOLATION (19) return code, and a message such as the following: Value of attribute attr contains extended (8-bit) characters: value

ACL PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

ACL Plugin

DN of Configuration Entry

cn=ACL Plugin,cn=plugins,cn=config

Description

ACL access check plug-in

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Leave this plug-in running at all times.

ACL PREOPERATION PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

ACL preoperation

DN of Configuration Entry

cn=ACL preoperation,cn=plugins,cn=config

Description

ACL access check plug-in.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

Database

Performance Related Information

Leave this plug-in running at all times.

BINARY SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Binary Syntax

DN of Configuration Entry

cn=Binary Syntax,cn=plugins,cn=config

Description

Syntax for handling binary data.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

BOOLEAN SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Boolean Syntax

DN of Configuration Entry

cn=Boolean Syntax,cn=plugins,cn=config

Description

Syntax for handling booleans.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CASE EXACT STRING SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Case Exact String Syntax

DN of Configuration Entry

cn=Case Exact String Syntax,cn=plugins,cn=config

Description

Syntax for handling case-sensitive strings.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CASE IGNORE STRING SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Case Ignore String Syntax

DN of Configuration Entry

cn=Case Ignore String Syntax,cn=plugins,cn=config

Description

Syntax for handling case-insensitive strings.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CHAINING DATABASE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Chaining Database

DN of Configuration Entry

cn=Chaining database,cn=plugins,cn=config

Description

Syntax for handling DNs.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CLASS OF SERVICE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Class of Service

DN of Configuration Entry

cn=Class of Service,cn=plugins,cn=config

Description

Allows for sharing of attributes between entries.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

Set the nsslapd-pluginarg0 attribute to:

• 0 (default) to enable fast lookup of classic CoS templates

• 1 to disable fast lookup for classic CoS template selection

• 2 to disable checks for ambiguous pointer and classic CoS definitions

  Ambiguous definitions result when more than one value could be returned for the same attribute of the same entry. When checking remains enabled, Directory Server logs an informational message upon encountering such an ambiguity, provided you have set the log level to allow plug-ins to log informational messages.

• 3 to disable both

Restart Directory Server for modifications to take effect.

Dependencies

None

Performance Related Information

Leave this plug-in running at all times.

COUNTRY STRING SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Country String Syntax

DN of Configuration Entry

cn=Country String Syntax,cn=plugins,cn=config

Description

Syntax for handling countries.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

DISTINGUISHED NAME SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Distinguished Name Syntax

DN of Configuration Entry

cn=Distinguished Name Syntax,cn=plugins,cn=config

Description

Syntax for handling DNs.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

DSML FRONTEND SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Frontend

DN of Configuration Entry

cn=DSMLv2-SOAP-HTTP,cn=frontends,cn=plugins, cn=config

Description

Enables you to access the directory using DSML v2 over SOAP/HTTP.

Configurable Options

on | off

Default Setting

off

Configurable Arguments

ds-hdsml-soapschemalocation

ds-hdsml-dsmlschemalocation

Dependencies

None

Performance Related Information

None

GENERALIZED TIME SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Generalized Time Syntax

DN of Configuration Entry

cn=Generalized Time Syntax,cn=plugins,cn=config

Description

Syntax for dealing with dates, times, and time zones.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

Further Information

The Generalized Time String consists of the four digit year, two digit month (for example, 01 for January), two digit day, two digit hour, two digit minute, two digit second, an optional decimal part of a second and a time zone indication. We strongly recommend that you use the Z time zone indication (Greenwich Mean Time).

INTEGER SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Integer Syntax

DN of Configuration Entry

cn=Integer Syntax,cn=plugins,cn=config

Description

Syntax for handling integers.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

INTERNATIONALIZATION PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Internationalization Plugin

DN of Configuration Entry

cn=Internationalization Plugin,cn=plugins,cn=config

Description

Syntax for handling DNs.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None. In contrast to previous versions of Directory Server, the collation orders and locales used by the internationalization plug-in are now stored in the configuration.

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

LDBM DATABASE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

ldbm database plug-in

DN of Configuration Entry

cn=ldbm database plug-in,cn=plugins,cn=config

Description

Implements local databases.

Configurable Options

None

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Leave this plug-in running at all times.

MULTIMASTER REPLICATION PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Multimaster Replication Plugin

DN of Configuration Entry

cn=Multimaster Replication plugin,cn=plugins, cn=config

Description

Enables replication between two Directory Server suffixes.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

database

Performance Related Information

None

Further Information

You can turn this plug-in off if you have only one server, which will never replicate.

OCTET STRING SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Octet String Syntax

DN of Configuration Entry

cn=Octet String Syntax,cn=plugins,cn=config

Description

Syntax for handling octet strings.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CLEAR PASSWORD STORAGE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

CLEAR

DN of Configuration Entry

cn=CLEAR,cn=Password Storage Schemes,cn=plugins, cn=config

Description

CLEAR password storage scheme used for password encryption.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CRYPT PASSWORD STORAGE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

CRYPT

DN of Configuration Entry

cn=CRYPT,cn=Password Storage Schemes,cn=plugins, cn=config

Description

CRYPT password storage scheme used for password encryption.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

NS-MTA-MD5 PASSWORD STORAGE SCHEME PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

NS-MTA-MD5

DN of Configuration Entry

cn=NS-MTA-MD5,cn=Password Storage Schemes, cn=plugins,cn=config

Description

NS-MTA-MD5 password storage scheme for password encryption.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

Further Information

You can no longer choose to encrypt passwords using the NS-MTA-MD5 password storage scheme. The storage scheme is still present, but for backward compatibility only. The data in your directory still contains passwords encrypted with the NS-MTA-MD5 password storage scheme.

RMCE PASSWORD STORAGE SCHEME PLUG-IN

This password storage scheme plug-in is used for example by the administration framework and is reserved for internal use.

SHA PASSWORD STORAGE SCHEME PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

SHA

DN of Configuration Entry

cn=SHA,cn=Password Storage Schemes,cn=plugins, cn=config

Description

SHA password storage scheme for password encryption.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

If there are no passwords encrypted using the SHA password storage scheme, you may turn this plug-in off. If you want to encrypt your password with the SHA password storage scheme, choose SSHA instead. SSHA is a far more secure option.

SSHA PASSWORD STORAGE SCHEME PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

SSHA

DN of Configuration Entry

cn=SSHA,cn=Password Storage Schemes,cn=plugins, cn=config

Description

SSHA password storage scheme for password encryption.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

STRONG PASSWORD CHECK PLUG-IN

When Directory Server is configured to check password quality, and this plug-in is enabled, the plug-in checks the following each time a password is added or modified.

• Clear text password values contain the classes of characters specified by the configuration.

• Clear text password values do not contain any sequence of four characters present in the dictionary file specified by the configuration.

Hashed password values such as {SSHA}0Ri1g2yqlH3GTZcuRQ4uS22syCQLBKAU2ypLSw== are not checked.

Consider the following aspects of this plug-in.

Plug-In Name

Strong Password Checking plug-in

DN of Configuration Entry

cn=Strong Password Check,cn=plugins,cn=config

Configurable options and arguments

on | off

nsslapd-pluginarg0, which takes an integer representing a mask of values representing the character classes that must be present in a valid password. Set nsslapd-pluginarg0 to one of or a sum of the following values, not counting the special values 16 and 17.

• 1 means the password must contain special characters.

• 2 means the password must contain numeric characters.

• 4 means the password must contain upper case characters.

• 8 means the password must contain lower case characters.

• 16 is a special value meaning at least three of the four character classes.

• 17 is a special value meaning at least two of the four character classes.

The default setting is 15.

nsslapd-pluginarg1, which takes the absolute file system path to an ASCII dictionary file. If the argument is missing, the dictionary check is skipped. The plug-in does not initialize and Directory Server does not start if the value of this attribute is invalid or refers to an inaccessible file.

Default settings

off

Dependencies

Default password file, install-path/resources/plugins/words-english-big.txt

POSTAL ADDRESS STRING SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Postal Address Syntax

DN of Configuration Entry

cn=Postal Address Syntax,cn=plugins,cn=config

Description

Syntax used for handling postal addresses.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

PTA PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Pass Through Authentication

DN of Configuration Entry

cn=Pass Through Authentication,cn=plugins, cn=config

Description

Enables pass-through authentication, the mechanism that allows one directory to consult another to authenticate bind requests.

Configurable Options

on | off

Default Setting

off

Configurable Arguments

The LDAP URL to the configuration directory.

nsslapd-pluginarg0: ldap://config.example.com/o=example

Dependencies

None

REFERENTIAL INTEGRITY POSTOPERATION PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Referential Integrity Postoperation

DN of Configuration Entry

cn=Referential Integrity Postoperation, cn=plugins,cn=config

Description

Enables the server to ensure referential integrity.

All attributes in all databases that are used by the referential integrity plug-in must be indexed. The indexes need to be created in the configuration of all the databases. When the retro change log is enabled, the cn=changelog suffix must be indexed.

Configurable Options

All configuration and on | off

Default Setting

off

Configurable Arguments

When enabled, the post operation Referential Integrity plug-in performs integrity updates on the member, uniquemember, owner, and seeAlso attributes immediately after a delete or rename operation. You can reconfigure the plug-in to perform integrity checks on all other attributes.

The following arguments are configurable:

1. (nsslapd-pluginarg0) Check for referential integrity

   -1 = no check for referential integrity

   0 = check for referential integrity is performed immediately

   positive integer = request for referential integrity is queued and processed at a later stage. This positive integer serves as a wake-up call for the thread to process the request, at intervals corresponding to the integer specified.

2. (nsslapd-pluginarg1) Log file for storing the change, for example /local/dsInst/logs/referint

3. (nsslapd-pluginarg2) Reserved for future use.

4. (Other nsslapd-pluginarg* attributes) Attribute names to be checked for referential integrity.

Dependencies

database type

Tuning Recommendations

Do the following when you use the referential integrity plug-in in a multi-master replication environment:

• Enable the referential integrity plug-in on all servers containing master replicas

• Enable the referential integrity plug-in with the same configuration on every master

Set the first argument to a positive value, such as 10, meaning ten seconds, to ensure that work performed by this plug-in happens asynchronously, rather than synchronously.

When enabling the plug-in, also create equality indexes for all attributes configured for use with the plug-in. The plug-in uses such indexes when searching for entries to update. Without equality indexes for the attributes it uses, the plug-in must perform costly unindexed searches that have negative impact on performance.

RETRO CHANGE LOG PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Retro Changelog Plugin

DN of Configuration Entry

cn=Retro Changelog Plugin,cn=plugins,cn=config

Description

Used by LDAP clients for maintaining application compatibility with Directory Server 4.x versions.

Maintains a log of all changes occurring in Directory Server. The retro change log offers the same functionality as the changelog in the 4.x versions of Directory Server.

Configurable Options

on | off

Default Setting

off

Configurable Arguments

The following arguments can be configured for the retro change log plug-in:

• nsslapd-pluginarg0: -ignore_attributesconfigures the retro change log plug-in to ignore attributes specified by the following nsslapd-pluginarg. This argument is configured by default.

• nsslapd-pluginarg1: copyingFromspecifies a list of attributes to be ignored by the preceding nsslapd-pluginarg. This argument is configured by default.

• nsslapd-pluginarg2: suffixes="suffix1","suffix2" configures the retro change log to record updates to specified suffixes only

• nsslapd-pluginarg3: deletedEntryAttributes=attribute1,attribute2 configures the retro change log to record specified attributes of an entry when that entry is deleted

Dependencies

None

Performance Related Information

May slow down Directory Server performance.

Example Configuration

dn: cn=Retro Changelog Plugin,cn=plugins,cn=config
objectClass: top
objectClass: nsSlapdPlugin
objectClass: ds-signedPlugin
objectClass: extensibleObject
cn: Retro Changelog Plugin
nsslapd-pluginPath: /opt/SUNWdsee7/lib/sparcv9/retrocl-plugin.so
nsslapd-pluginInitfunc: retrocl_plugin_init
nsslapd-pluginType: object
nsslapd-plugin-depends-on-type: database
nsslapd-pluginarg0: -ignore_attributes
nsslapd-pluginarg1: copyingFrom
nsslapd-pluginarg2: suffixes="ou=people","dc=example","dc=com"
nsslapd-pluginarg3: deletedEntryAtrributes="objectclass","employeenumber"
nsslapd-changelogdir: /local/dsInst/db/changelog
nsslapd-pluginEnabled: on
nsslapd-pluginId: retrocl
nsslapd-pluginVersion: 11.1.1.3.0
nsslapd-pluginVendor: Sun Microsystems, Inc.
nsslapd-pluginDescription: Retrocl Plugin
ds-pluginSignatureState: valid signature

ROLES PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Roles Plugin

DN of Configuration Entry

cn=Roles Plugin,cn=plugins,cn=config

Description

Enables the use of roles in Directory Server.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

State Change Plugin

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

STATE CHANGE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

State Change Plugin

DN of Configuration Entry

cn=State Change Plugin,cn=plugins,cn=config

Description

State change notification service plug-in for detecting updates, such as configuration changes, and triggering callbacks when updates happen.

This plug-in is used internally by the roles plug-in.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

SUBTREE ENTRY COUNTER PLUG-INS

Consider the following aspects of this plug-in.

Plug-In Name

Subtree Entry Counter For ObjectClass

DN of Configuration Entry

cn=Subtree Entry Counter for ObjectClass,cn=plugins, cn=config

Description

Maintain a count of entries with a particular object class. The following plug-ins are provided.

• Subtree entry counter for departments in domains

• Subtree entry counter for domains within a domain

• Subtree entry counter for mail lists

• Subtree entry counter for nested departments

• Subtree entry counter for total domains

• Subtree entry counter for users

Configurable Options

on | off

Default Setting

off

Configurable Arguments

None

Dependencies

None

Performance Related Information

These plug-ins are provided for use with Messaging Server only, and are disabled by default. Leave these plug-ins disabled unless your Messaging Server requires them.

Counter Attributes Maintained

nsNumDepts

Either the number of departments within a domain, or the number of departments within a department (nested departments), depending on the DN of the entry.

nsNumDomains

Either the number of total domains, or the number of domains within a domain or nested domain, depending on the DN of the entry.

nsNumMailLists

Number of mail lists.

TELEPHONE SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Telephone Syntax

DN of Configuration Entry

cn=Telephone Syntax,cn=plugins,cn=config

Description

Syntax for handling telephone numbers.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

UID UNIQUENESS PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

UID Uniqueness

DN of Configuration Entry

cn=UID Uniqueness,cn=plugins,cn=config

Description

Checks that the values of specified attributes are unique each time a modification occurs on an entry.

Configurable Options

on | off

Default Setting

off

Configurable Arguments

You may configure this plug-in in either of two different ways.

1. Specify attributes that must be unique for a series of one or more subtrees identified by DNs. For example, to specify that employeeNumber and uid attribute values must be unique across both o=org1,dc=example,dc=com and o=org2,dc=example,dc=com , configure the arguments in the configuration entry as follows:

   nsslapd-pluginarg0: employeeNumber
   nsslapd-pluginarg1: uid
   nsslapd-pluginarg2: o=org1,dc=example,dc=com
   nsslapd-pluginarg3: o=org2,dc=example,dc=com

2. You specify attributes that must be unique inside congruent subtrees, optionally only on entries of a specified object class. For example, to specify that employeeNumber and uid attribute values must be unique in either o=org1,dc=example,dc=com or o=org2,dc=example,dc=com, but only on entries of the inetOrgPerson object class, configure the arguments in the configuration entry as follows:

   nsslapd-pluginarg0: employeeNumber
   nsslapd-pluginarg1: uid
   nsslapd-pluginarg2: MarkerObjectClass="organization"
    RequiredObjectClass="inetOrgPerson"

Dependencies

database type

Performance Related Information

Directory Server provides the UID Uniqueness plug-in by default. To ensure unique values for other attributes, you can create instances of the UID Uniqueness plug-in for those attributes.

The UID Uniqueness plug-in may slow down Directory Server performance.

URI PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

URI Syntax

DN of Configuration Entry

cn=URI Syntax,cn=plugins,cn=config

Description

Syntax for handling URIs (Unique Resource Identifiers) including URLs (Unique Resource Locators.)

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised June 2010

Name | Description | Attributes | See Also

nsslapd-pluginType(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-plugin, nsslapd-plugin-depends-on-named, nsslapd-plugin-depends-on-type, nsslapd-pluginDescription, nsslapd-pluginEnabled, nsslapd-pluginId, nsslapd-pluginInitfunc, nsslapd-pluginPath, nsslapd-pluginType, nsslapd-pluginVendor, nsslapd-pluginVersion – Directory Server plug-in legacy configuration

Description

The nsslapd-plugin attribute on cn=config is multi-valued, read-only attribute lists the syntaxes and matching rules loaded by the server. This manual page covers server plug-in configuration, rather than the nsslapd-plugin attribute.

This manual page provides an overview of legacy configuration information for server plug-ins. This manual page covers the individual plug-in configuration entry attributes. Also, this manual page covers the plug-ins provided with Directory Server, including configurable options, configurable arguments, default setting, dependencies, general performance related information, and further reading.

---

Note –

In most circumstances, you configure plug-in functionality using the dsconf(1M) command. See plugin(5dsconf) for a list of configurable properties.

---

ATTRIBUTES FOR PLUG-IN CONFIGURATION ENTRIES

The following list covers each plug-in configuration entry attribute.

nsslapd-plugin-depends-on-named

This is a multivalued attribute, used to ensure that plug-ins are called by the server in the correct order. It takes a value that corresponds to the cn value of a plug-in. The plug-in whose cn value matches one of the values below it is started by the server prior to this plug-in. If the plug-in does not exist, the server fails to start.

Entry DN

cn=pluginName,cn=plugins, cn=config

Valid Range

Plug-in name

Default Value

None

Syntax

DirectoryString

Example

nsslapd-plugin-depends-on-named: Class of Service

nsslapd-plugin-depends-on-type

This is a multivalued attribute, used to ensure that plug-ins are called by the server in the correct order. It takes a value that corresponds to the type of a plug-in, contained in the attribute nsslapd-pluginType, and requires that plug-ins of that type are started before the present plug-in.

Entry DN

cn=pluginName,cn=plugins, cn=config

Valid Range

Plug-in type

Default Value

None

Syntax

DirectoryString

Example

nsslapd-plugin-depends-on-type: database

nsslapd-pluginDescription

Provides a description of the plug-in.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any DirectoryString

Default Value

None

Syntax

DirectoryString

Example

nsslapd-pluginDescription: acl access check plug-in

nsslapd-pluginEnabled

Specifies whether or not the plug-in is enabled. This attribute can be changed over protocol, but will only take effect when the server is next restarted.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

on | off

Default Value

on

Syntax

DirectoryString

Example

nsslapd-pluginEnabled: on

nsslapd-pluginId

Specifies the plug-in ID.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any valid plug-in ID.

Default Value

None

Syntax

DirectoryString

Example

nsslapd-pluginId: chaining database

nsslapd-pluginInitfunc

Specifies the plug-in function to be initiated.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any valid plug-in function.

Default Value

None

Syntax

DirectoryString

Example

nsslapd-pluginInitfunc: NS7bitAttr_Init

nsslapd-pluginPath

Specifies the full path to the plug-in.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any valid path

Default Value

None

Syntax

DirectoryString

Example

nsslapd-pluginPath: /opt/SUNWdsee7/lib/sparcv9/uid-plugin.so

nsslapd-pluginType

Specifies the plug-in type.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any valid plug-in type.

Default Value

None

Syntax

DirectoryString

Example

nsslapd-pluginType: preoperation

nsslapd-pluginVendor

Specifies the vendor of the plug-in.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any approved plug-in vendor.

Default Value

Sun Microsystems, Inc.

Syntax

DirectoryString

Example

nsslapd-pluginVendor: Sun Microsystems, Inc.

nsslapd-pluginVersion

Specifies the plug-in version.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any valid plug-in version.

Default Value

Product version

Syntax

DirectoryString

Example

nsslapd-pluginVersion: 11.1.1.3.0

7-BIT CHECK PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

7-Bit Check (NS7bitAttr)

DN of Configuration Entry

cn=7-bit check,cn=plugins,cn=config

Description

Checks certain attributes are seven-bit clean.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

List of attributes, uid mail userpassword, followed by a comma, and then by the suffix or suffixes on which the check is to occur.

Dependencies

None

Performance Related Information

None

Further Information

If your Directory Server uses non-ASCII characters such as Japanese and other languages for some attributes, remove those attributes from the list of attributes checked by this plug-in.

When adding or modifying an attribute value checked by this plug-in, and the new value violates the seven-bit check, the client receives a LDAP_CONSTRAINT_VIOLATION (19) return code, and a message such as the following: Value of attribute attr contains extended (8-bit) characters: value

ACL PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

ACL Plugin

DN of Configuration Entry

cn=ACL Plugin,cn=plugins,cn=config

Description

ACL access check plug-in

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Leave this plug-in running at all times.

ACL PREOPERATION PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

ACL preoperation

DN of Configuration Entry

cn=ACL preoperation,cn=plugins,cn=config

Description

ACL access check plug-in.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

Database

Performance Related Information

Leave this plug-in running at all times.

BINARY SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Binary Syntax

DN of Configuration Entry

cn=Binary Syntax,cn=plugins,cn=config

Description

Syntax for handling binary data.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

BOOLEAN SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Boolean Syntax

DN of Configuration Entry

cn=Boolean Syntax,cn=plugins,cn=config

Description

Syntax for handling booleans.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CASE EXACT STRING SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Case Exact String Syntax

DN of Configuration Entry

cn=Case Exact String Syntax,cn=plugins,cn=config

Description

Syntax for handling case-sensitive strings.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CASE IGNORE STRING SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Case Ignore String Syntax

DN of Configuration Entry

cn=Case Ignore String Syntax,cn=plugins,cn=config

Description

Syntax for handling case-insensitive strings.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CHAINING DATABASE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Chaining Database

DN of Configuration Entry

cn=Chaining database,cn=plugins,cn=config

Description

Syntax for handling DNs.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CLASS OF SERVICE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Class of Service

DN of Configuration Entry

cn=Class of Service,cn=plugins,cn=config

Description

Allows for sharing of attributes between entries.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

Set the nsslapd-pluginarg0 attribute to:

• 0 (default) to enable fast lookup of classic CoS templates

• 1 to disable fast lookup for classic CoS template selection

• 2 to disable checks for ambiguous pointer and classic CoS definitions

  Ambiguous definitions result when more than one value could be returned for the same attribute of the same entry. When checking remains enabled, Directory Server logs an informational message upon encountering such an ambiguity, provided you have set the log level to allow plug-ins to log informational messages.

• 3 to disable both

Restart Directory Server for modifications to take effect.

Dependencies

None

Performance Related Information

Leave this plug-in running at all times.

COUNTRY STRING SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Country String Syntax

DN of Configuration Entry

cn=Country String Syntax,cn=plugins,cn=config

Description

Syntax for handling countries.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

DISTINGUISHED NAME SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Distinguished Name Syntax

DN of Configuration Entry

cn=Distinguished Name Syntax,cn=plugins,cn=config

Description

Syntax for handling DNs.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

DSML FRONTEND SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Frontend

DN of Configuration Entry

cn=DSMLv2-SOAP-HTTP,cn=frontends,cn=plugins, cn=config

Description

Enables you to access the directory using DSML v2 over SOAP/HTTP.

Configurable Options

on | off

Default Setting

off

Configurable Arguments

ds-hdsml-soapschemalocation

ds-hdsml-dsmlschemalocation

Dependencies

None

Performance Related Information

None

GENERALIZED TIME SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Generalized Time Syntax

DN of Configuration Entry

cn=Generalized Time Syntax,cn=plugins,cn=config

Description

Syntax for dealing with dates, times, and time zones.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

Further Information

The Generalized Time String consists of the four digit year, two digit month (for example, 01 for January), two digit day, two digit hour, two digit minute, two digit second, an optional decimal part of a second and a time zone indication. We strongly recommend that you use the Z time zone indication (Greenwich Mean Time).

INTEGER SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Integer Syntax

DN of Configuration Entry

cn=Integer Syntax,cn=plugins,cn=config

Description

Syntax for handling integers.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

INTERNATIONALIZATION PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Internationalization Plugin

DN of Configuration Entry

cn=Internationalization Plugin,cn=plugins,cn=config

Description

Syntax for handling DNs.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None. In contrast to previous versions of Directory Server, the collation orders and locales used by the internationalization plug-in are now stored in the configuration.

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

LDBM DATABASE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

ldbm database plug-in

DN of Configuration Entry

cn=ldbm database plug-in,cn=plugins,cn=config

Description

Implements local databases.

Configurable Options

None

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Leave this plug-in running at all times.

MULTIMASTER REPLICATION PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Multimaster Replication Plugin

DN of Configuration Entry

cn=Multimaster Replication plugin,cn=plugins, cn=config

Description

Enables replication between two Directory Server suffixes.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

database

Performance Related Information

None

Further Information

You can turn this plug-in off if you have only one server, which will never replicate.

OCTET STRING SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Octet String Syntax

DN of Configuration Entry

cn=Octet String Syntax,cn=plugins,cn=config

Description

Syntax for handling octet strings.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CLEAR PASSWORD STORAGE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

CLEAR

DN of Configuration Entry

cn=CLEAR,cn=Password Storage Schemes,cn=plugins, cn=config

Description

CLEAR password storage scheme used for password encryption.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CRYPT PASSWORD STORAGE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

CRYPT

DN of Configuration Entry

cn=CRYPT,cn=Password Storage Schemes,cn=plugins, cn=config

Description

CRYPT password storage scheme used for password encryption.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

NS-MTA-MD5 PASSWORD STORAGE SCHEME PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

NS-MTA-MD5

DN of Configuration Entry

cn=NS-MTA-MD5,cn=Password Storage Schemes, cn=plugins,cn=config

Description

NS-MTA-MD5 password storage scheme for password encryption.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

Further Information

You can no longer choose to encrypt passwords using the NS-MTA-MD5 password storage scheme. The storage scheme is still present, but for backward compatibility only. The data in your directory still contains passwords encrypted with the NS-MTA-MD5 password storage scheme.

RMCE PASSWORD STORAGE SCHEME PLUG-IN

This password storage scheme plug-in is used for example by the administration framework and is reserved for internal use.

SHA PASSWORD STORAGE SCHEME PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

SHA

DN of Configuration Entry

cn=SHA,cn=Password Storage Schemes,cn=plugins, cn=config

Description

SHA password storage scheme for password encryption.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

If there are no passwords encrypted using the SHA password storage scheme, you may turn this plug-in off. If you want to encrypt your password with the SHA password storage scheme, choose SSHA instead. SSHA is a far more secure option.

SSHA PASSWORD STORAGE SCHEME PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

SSHA

DN of Configuration Entry

cn=SSHA,cn=Password Storage Schemes,cn=plugins, cn=config

Description

SSHA password storage scheme for password encryption.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

STRONG PASSWORD CHECK PLUG-IN

When Directory Server is configured to check password quality, and this plug-in is enabled, the plug-in checks the following each time a password is added or modified.

• Clear text password values contain the classes of characters specified by the configuration.

• Clear text password values do not contain any sequence of four characters present in the dictionary file specified by the configuration.

Hashed password values such as {SSHA}0Ri1g2yqlH3GTZcuRQ4uS22syCQLBKAU2ypLSw== are not checked.

Consider the following aspects of this plug-in.

Plug-In Name

Strong Password Checking plug-in

DN of Configuration Entry

cn=Strong Password Check,cn=plugins,cn=config

Configurable options and arguments

on | off

nsslapd-pluginarg0, which takes an integer representing a mask of values representing the character classes that must be present in a valid password. Set nsslapd-pluginarg0 to one of or a sum of the following values, not counting the special values 16 and 17.

• 1 means the password must contain special characters.

• 2 means the password must contain numeric characters.

• 4 means the password must contain upper case characters.

• 8 means the password must contain lower case characters.

• 16 is a special value meaning at least three of the four character classes.

• 17 is a special value meaning at least two of the four character classes.

The default setting is 15.

nsslapd-pluginarg1, which takes the absolute file system path to an ASCII dictionary file. If the argument is missing, the dictionary check is skipped. The plug-in does not initialize and Directory Server does not start if the value of this attribute is invalid or refers to an inaccessible file.

Default settings

off

Dependencies

Default password file, install-path/resources/plugins/words-english-big.txt

POSTAL ADDRESS STRING SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Postal Address Syntax

DN of Configuration Entry

cn=Postal Address Syntax,cn=plugins,cn=config

Description

Syntax used for handling postal addresses.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

PTA PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Pass Through Authentication

DN of Configuration Entry

cn=Pass Through Authentication,cn=plugins, cn=config

Description

Enables pass-through authentication, the mechanism that allows one directory to consult another to authenticate bind requests.

Configurable Options

on | off

Default Setting

off

Configurable Arguments

The LDAP URL to the configuration directory.

nsslapd-pluginarg0: ldap://config.example.com/o=example

Dependencies

None

REFERENTIAL INTEGRITY POSTOPERATION PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Referential Integrity Postoperation

DN of Configuration Entry

cn=Referential Integrity Postoperation, cn=plugins,cn=config

Description

Enables the server to ensure referential integrity.

All attributes in all databases that are used by the referential integrity plug-in must be indexed. The indexes need to be created in the configuration of all the databases. When the retro change log is enabled, the cn=changelog suffix must be indexed.

Configurable Options

All configuration and on | off

Default Setting

off

Configurable Arguments

When enabled, the post operation Referential Integrity plug-in performs integrity updates on the member, uniquemember, owner, and seeAlso attributes immediately after a delete or rename operation. You can reconfigure the plug-in to perform integrity checks on all other attributes.

The following arguments are configurable:

1. (nsslapd-pluginarg0) Check for referential integrity

   -1 = no check for referential integrity

   0 = check for referential integrity is performed immediately

   positive integer = request for referential integrity is queued and processed at a later stage. This positive integer serves as a wake-up call for the thread to process the request, at intervals corresponding to the integer specified.

2. (nsslapd-pluginarg1) Log file for storing the change, for example /local/dsInst/logs/referint

3. (nsslapd-pluginarg2) Reserved for future use.

4. (Other nsslapd-pluginarg* attributes) Attribute names to be checked for referential integrity.

Dependencies

database type

Tuning Recommendations

Do the following when you use the referential integrity plug-in in a multi-master replication environment:

• Enable the referential integrity plug-in on all servers containing master replicas

• Enable the referential integrity plug-in with the same configuration on every master

Set the first argument to a positive value, such as 10, meaning ten seconds, to ensure that work performed by this plug-in happens asynchronously, rather than synchronously.

When enabling the plug-in, also create equality indexes for all attributes configured for use with the plug-in. The plug-in uses such indexes when searching for entries to update. Without equality indexes for the attributes it uses, the plug-in must perform costly unindexed searches that have negative impact on performance.

RETRO CHANGE LOG PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Retro Changelog Plugin

DN of Configuration Entry

cn=Retro Changelog Plugin,cn=plugins,cn=config

Description

Used by LDAP clients for maintaining application compatibility with Directory Server 4.x versions.

Maintains a log of all changes occurring in Directory Server. The retro change log offers the same functionality as the changelog in the 4.x versions of Directory Server.

Configurable Options

on | off

Default Setting

off

Configurable Arguments

The following arguments can be configured for the retro change log plug-in:

• nsslapd-pluginarg0: -ignore_attributesconfigures the retro change log plug-in to ignore attributes specified by the following nsslapd-pluginarg. This argument is configured by default.

• nsslapd-pluginarg1: copyingFromspecifies a list of attributes to be ignored by the preceding nsslapd-pluginarg. This argument is configured by default.

• nsslapd-pluginarg2: suffixes="suffix1","suffix2" configures the retro change log to record updates to specified suffixes only

• nsslapd-pluginarg3: deletedEntryAttributes=attribute1,attribute2 configures the retro change log to record specified attributes of an entry when that entry is deleted

Dependencies

None

Performance Related Information

May slow down Directory Server performance.

Example Configuration

dn: cn=Retro Changelog Plugin,cn=plugins,cn=config
objectClass: top
objectClass: nsSlapdPlugin
objectClass: ds-signedPlugin
objectClass: extensibleObject
cn: Retro Changelog Plugin
nsslapd-pluginPath: /opt/SUNWdsee7/lib/sparcv9/retrocl-plugin.so
nsslapd-pluginInitfunc: retrocl_plugin_init
nsslapd-pluginType: object
nsslapd-plugin-depends-on-type: database
nsslapd-pluginarg0: -ignore_attributes
nsslapd-pluginarg1: copyingFrom
nsslapd-pluginarg2: suffixes="ou=people","dc=example","dc=com"
nsslapd-pluginarg3: deletedEntryAtrributes="objectclass","employeenumber"
nsslapd-changelogdir: /local/dsInst/db/changelog
nsslapd-pluginEnabled: on
nsslapd-pluginId: retrocl
nsslapd-pluginVersion: 11.1.1.3.0
nsslapd-pluginVendor: Sun Microsystems, Inc.
nsslapd-pluginDescription: Retrocl Plugin
ds-pluginSignatureState: valid signature

ROLES PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Roles Plugin

DN of Configuration Entry

cn=Roles Plugin,cn=plugins,cn=config

Description

Enables the use of roles in Directory Server.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

State Change Plugin

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

STATE CHANGE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

State Change Plugin

DN of Configuration Entry

cn=State Change Plugin,cn=plugins,cn=config

Description

State change notification service plug-in for detecting updates, such as configuration changes, and triggering callbacks when updates happen.

This plug-in is used internally by the roles plug-in.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

SUBTREE ENTRY COUNTER PLUG-INS

Consider the following aspects of this plug-in.

Plug-In Name

Subtree Entry Counter For ObjectClass

DN of Configuration Entry

cn=Subtree Entry Counter for ObjectClass,cn=plugins, cn=config

Description

Maintain a count of entries with a particular object class. The following plug-ins are provided.

• Subtree entry counter for departments in domains

• Subtree entry counter for domains within a domain

• Subtree entry counter for mail lists

• Subtree entry counter for nested departments

• Subtree entry counter for total domains

• Subtree entry counter for users

Configurable Options

on | off

Default Setting

off

Configurable Arguments

None

Dependencies

None

Performance Related Information

These plug-ins are provided for use with Messaging Server only, and are disabled by default. Leave these plug-ins disabled unless your Messaging Server requires them.

Counter Attributes Maintained

nsNumDepts

Either the number of departments within a domain, or the number of departments within a department (nested departments), depending on the DN of the entry.

nsNumDomains

Either the number of total domains, or the number of domains within a domain or nested domain, depending on the DN of the entry.

nsNumMailLists

Number of mail lists.

TELEPHONE SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Telephone Syntax

DN of Configuration Entry

cn=Telephone Syntax,cn=plugins,cn=config

Description

Syntax for handling telephone numbers.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

UID UNIQUENESS PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

UID Uniqueness

DN of Configuration Entry

cn=UID Uniqueness,cn=plugins,cn=config

Description

Checks that the values of specified attributes are unique each time a modification occurs on an entry.

Configurable Options

on | off

Default Setting

off

Configurable Arguments

You may configure this plug-in in either of two different ways.

1. Specify attributes that must be unique for a series of one or more subtrees identified by DNs. For example, to specify that employeeNumber and uid attribute values must be unique across both o=org1,dc=example,dc=com and o=org2,dc=example,dc=com , configure the arguments in the configuration entry as follows:

   nsslapd-pluginarg0: employeeNumber
   nsslapd-pluginarg1: uid
   nsslapd-pluginarg2: o=org1,dc=example,dc=com
   nsslapd-pluginarg3: o=org2,dc=example,dc=com

2. You specify attributes that must be unique inside congruent subtrees, optionally only on entries of a specified object class. For example, to specify that employeeNumber and uid attribute values must be unique in either o=org1,dc=example,dc=com or o=org2,dc=example,dc=com, but only on entries of the inetOrgPerson object class, configure the arguments in the configuration entry as follows:

   nsslapd-pluginarg0: employeeNumber
   nsslapd-pluginarg1: uid
   nsslapd-pluginarg2: MarkerObjectClass="organization"
    RequiredObjectClass="inetOrgPerson"

Dependencies

database type

Performance Related Information

Directory Server provides the UID Uniqueness plug-in by default. To ensure unique values for other attributes, you can create instances of the UID Uniqueness plug-in for those attributes.

The UID Uniqueness plug-in may slow down Directory Server performance.

URI PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

URI Syntax

DN of Configuration Entry

cn=URI Syntax,cn=plugins,cn=config

Description

Syntax for handling URIs (Unique Resource Identifiers) including URLs (Unique Resource Locators.)

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised June 2010

Name | Description | Attributes | See Also

nsslapd-pluginVendor(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-plugin, nsslapd-plugin-depends-on-named, nsslapd-plugin-depends-on-type, nsslapd-pluginDescription, nsslapd-pluginEnabled, nsslapd-pluginId, nsslapd-pluginInitfunc, nsslapd-pluginPath, nsslapd-pluginType, nsslapd-pluginVendor, nsslapd-pluginVersion – Directory Server plug-in legacy configuration

Description

The nsslapd-plugin attribute on cn=config is multi-valued, read-only attribute lists the syntaxes and matching rules loaded by the server. This manual page covers server plug-in configuration, rather than the nsslapd-plugin attribute.

This manual page provides an overview of legacy configuration information for server plug-ins. This manual page covers the individual plug-in configuration entry attributes. Also, this manual page covers the plug-ins provided with Directory Server, including configurable options, configurable arguments, default setting, dependencies, general performance related information, and further reading.

---

Note –

In most circumstances, you configure plug-in functionality using the dsconf(1M) command. See plugin(5dsconf) for a list of configurable properties.

---

ATTRIBUTES FOR PLUG-IN CONFIGURATION ENTRIES

The following list covers each plug-in configuration entry attribute.

nsslapd-plugin-depends-on-named

This is a multivalued attribute, used to ensure that plug-ins are called by the server in the correct order. It takes a value that corresponds to the cn value of a plug-in. The plug-in whose cn value matches one of the values below it is started by the server prior to this plug-in. If the plug-in does not exist, the server fails to start.

Entry DN

cn=pluginName,cn=plugins, cn=config

Valid Range

Plug-in name

Default Value

None

Syntax

DirectoryString

Example

nsslapd-plugin-depends-on-named: Class of Service

nsslapd-plugin-depends-on-type

This is a multivalued attribute, used to ensure that plug-ins are called by the server in the correct order. It takes a value that corresponds to the type of a plug-in, contained in the attribute nsslapd-pluginType, and requires that plug-ins of that type are started before the present plug-in.

Entry DN

cn=pluginName,cn=plugins, cn=config

Valid Range

Plug-in type

Default Value

None

Syntax

DirectoryString

Example

nsslapd-plugin-depends-on-type: database

nsslapd-pluginDescription

Provides a description of the plug-in.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any DirectoryString

Default Value

None

Syntax

DirectoryString

Example

nsslapd-pluginDescription: acl access check plug-in

nsslapd-pluginEnabled

Specifies whether or not the plug-in is enabled. This attribute can be changed over protocol, but will only take effect when the server is next restarted.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

on | off

Default Value

on

Syntax

DirectoryString

Example

nsslapd-pluginEnabled: on

nsslapd-pluginId

Specifies the plug-in ID.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any valid plug-in ID.

Default Value

None

Syntax

DirectoryString

Example

nsslapd-pluginId: chaining database

nsslapd-pluginInitfunc

Specifies the plug-in function to be initiated.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any valid plug-in function.

Default Value

None

Syntax

DirectoryString

Example

nsslapd-pluginInitfunc: NS7bitAttr_Init

nsslapd-pluginPath

Specifies the full path to the plug-in.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any valid path

Default Value

None

Syntax

DirectoryString

Example

nsslapd-pluginPath: /opt/SUNWdsee7/lib/sparcv9/uid-plugin.so

nsslapd-pluginType

Specifies the plug-in type.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any valid plug-in type.

Default Value

None

Syntax

DirectoryString

Example

nsslapd-pluginType: preoperation

nsslapd-pluginVendor

Specifies the vendor of the plug-in.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any approved plug-in vendor.

Default Value

Sun Microsystems, Inc.

Syntax

DirectoryString

Example

nsslapd-pluginVendor: Sun Microsystems, Inc.

nsslapd-pluginVersion

Specifies the plug-in version.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any valid plug-in version.

Default Value

Product version

Syntax

DirectoryString

Example

nsslapd-pluginVersion: 11.1.1.3.0

7-BIT CHECK PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

7-Bit Check (NS7bitAttr)

DN of Configuration Entry

cn=7-bit check,cn=plugins,cn=config

Description

Checks certain attributes are seven-bit clean.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

List of attributes, uid mail userpassword, followed by a comma, and then by the suffix or suffixes on which the check is to occur.

Dependencies

None

Performance Related Information

None

Further Information

If your Directory Server uses non-ASCII characters such as Japanese and other languages for some attributes, remove those attributes from the list of attributes checked by this plug-in.

When adding or modifying an attribute value checked by this plug-in, and the new value violates the seven-bit check, the client receives a LDAP_CONSTRAINT_VIOLATION (19) return code, and a message such as the following: Value of attribute attr contains extended (8-bit) characters: value

ACL PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

ACL Plugin

DN of Configuration Entry

cn=ACL Plugin,cn=plugins,cn=config

Description

ACL access check plug-in

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Leave this plug-in running at all times.

ACL PREOPERATION PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

ACL preoperation

DN of Configuration Entry

cn=ACL preoperation,cn=plugins,cn=config

Description

ACL access check plug-in.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

Database

Performance Related Information

Leave this plug-in running at all times.

BINARY SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Binary Syntax

DN of Configuration Entry

cn=Binary Syntax,cn=plugins,cn=config

Description

Syntax for handling binary data.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

BOOLEAN SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Boolean Syntax

DN of Configuration Entry

cn=Boolean Syntax,cn=plugins,cn=config

Description

Syntax for handling booleans.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CASE EXACT STRING SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Case Exact String Syntax

DN of Configuration Entry

cn=Case Exact String Syntax,cn=plugins,cn=config

Description

Syntax for handling case-sensitive strings.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CASE IGNORE STRING SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Case Ignore String Syntax

DN of Configuration Entry

cn=Case Ignore String Syntax,cn=plugins,cn=config

Description

Syntax for handling case-insensitive strings.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CHAINING DATABASE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Chaining Database

DN of Configuration Entry

cn=Chaining database,cn=plugins,cn=config

Description

Syntax for handling DNs.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CLASS OF SERVICE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Class of Service

DN of Configuration Entry

cn=Class of Service,cn=plugins,cn=config

Description

Allows for sharing of attributes between entries.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

Set the nsslapd-pluginarg0 attribute to:

• 0 (default) to enable fast lookup of classic CoS templates

• 1 to disable fast lookup for classic CoS template selection

• 2 to disable checks for ambiguous pointer and classic CoS definitions

  Ambiguous definitions result when more than one value could be returned for the same attribute of the same entry. When checking remains enabled, Directory Server logs an informational message upon encountering such an ambiguity, provided you have set the log level to allow plug-ins to log informational messages.

• 3 to disable both

Restart Directory Server for modifications to take effect.

Dependencies

None

Performance Related Information

Leave this plug-in running at all times.

COUNTRY STRING SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Country String Syntax

DN of Configuration Entry

cn=Country String Syntax,cn=plugins,cn=config

Description

Syntax for handling countries.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

DISTINGUISHED NAME SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Distinguished Name Syntax

DN of Configuration Entry

cn=Distinguished Name Syntax,cn=plugins,cn=config

Description

Syntax for handling DNs.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

DSML FRONTEND SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Frontend

DN of Configuration Entry

cn=DSMLv2-SOAP-HTTP,cn=frontends,cn=plugins, cn=config

Description

Enables you to access the directory using DSML v2 over SOAP/HTTP.

Configurable Options

on | off

Default Setting

off

Configurable Arguments

ds-hdsml-soapschemalocation

ds-hdsml-dsmlschemalocation

Dependencies

None

Performance Related Information

None

GENERALIZED TIME SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Generalized Time Syntax

DN of Configuration Entry

cn=Generalized Time Syntax,cn=plugins,cn=config

Description

Syntax for dealing with dates, times, and time zones.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

Further Information

The Generalized Time String consists of the four digit year, two digit month (for example, 01 for January), two digit day, two digit hour, two digit minute, two digit second, an optional decimal part of a second and a time zone indication. We strongly recommend that you use the Z time zone indication (Greenwich Mean Time).

INTEGER SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Integer Syntax

DN of Configuration Entry

cn=Integer Syntax,cn=plugins,cn=config

Description

Syntax for handling integers.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

INTERNATIONALIZATION PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Internationalization Plugin

DN of Configuration Entry

cn=Internationalization Plugin,cn=plugins,cn=config

Description

Syntax for handling DNs.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None. In contrast to previous versions of Directory Server, the collation orders and locales used by the internationalization plug-in are now stored in the configuration.

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

LDBM DATABASE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

ldbm database plug-in

DN of Configuration Entry

cn=ldbm database plug-in,cn=plugins,cn=config

Description

Implements local databases.

Configurable Options

None

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Leave this plug-in running at all times.

MULTIMASTER REPLICATION PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Multimaster Replication Plugin

DN of Configuration Entry

cn=Multimaster Replication plugin,cn=plugins, cn=config

Description

Enables replication between two Directory Server suffixes.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

database

Performance Related Information

None

Further Information

You can turn this plug-in off if you have only one server, which will never replicate.

OCTET STRING SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Octet String Syntax

DN of Configuration Entry

cn=Octet String Syntax,cn=plugins,cn=config

Description

Syntax for handling octet strings.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CLEAR PASSWORD STORAGE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

CLEAR

DN of Configuration Entry

cn=CLEAR,cn=Password Storage Schemes,cn=plugins, cn=config

Description

CLEAR password storage scheme used for password encryption.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CRYPT PASSWORD STORAGE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

CRYPT

DN of Configuration Entry

cn=CRYPT,cn=Password Storage Schemes,cn=plugins, cn=config

Description

CRYPT password storage scheme used for password encryption.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

NS-MTA-MD5 PASSWORD STORAGE SCHEME PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

NS-MTA-MD5

DN of Configuration Entry

cn=NS-MTA-MD5,cn=Password Storage Schemes, cn=plugins,cn=config

Description

NS-MTA-MD5 password storage scheme for password encryption.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

Further Information

You can no longer choose to encrypt passwords using the NS-MTA-MD5 password storage scheme. The storage scheme is still present, but for backward compatibility only. The data in your directory still contains passwords encrypted with the NS-MTA-MD5 password storage scheme.

RMCE PASSWORD STORAGE SCHEME PLUG-IN

This password storage scheme plug-in is used for example by the administration framework and is reserved for internal use.

SHA PASSWORD STORAGE SCHEME PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

SHA

DN of Configuration Entry

cn=SHA,cn=Password Storage Schemes,cn=plugins, cn=config

Description

SHA password storage scheme for password encryption.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

If there are no passwords encrypted using the SHA password storage scheme, you may turn this plug-in off. If you want to encrypt your password with the SHA password storage scheme, choose SSHA instead. SSHA is a far more secure option.

SSHA PASSWORD STORAGE SCHEME PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

SSHA

DN of Configuration Entry

cn=SSHA,cn=Password Storage Schemes,cn=plugins, cn=config

Description

SSHA password storage scheme for password encryption.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

STRONG PASSWORD CHECK PLUG-IN

When Directory Server is configured to check password quality, and this plug-in is enabled, the plug-in checks the following each time a password is added or modified.

• Clear text password values contain the classes of characters specified by the configuration.

• Clear text password values do not contain any sequence of four characters present in the dictionary file specified by the configuration.

Hashed password values such as {SSHA}0Ri1g2yqlH3GTZcuRQ4uS22syCQLBKAU2ypLSw== are not checked.

Consider the following aspects of this plug-in.

Plug-In Name

Strong Password Checking plug-in

DN of Configuration Entry

cn=Strong Password Check,cn=plugins,cn=config

Configurable options and arguments

on | off

nsslapd-pluginarg0, which takes an integer representing a mask of values representing the character classes that must be present in a valid password. Set nsslapd-pluginarg0 to one of or a sum of the following values, not counting the special values 16 and 17.

• 1 means the password must contain special characters.

• 2 means the password must contain numeric characters.

• 4 means the password must contain upper case characters.

• 8 means the password must contain lower case characters.

• 16 is a special value meaning at least three of the four character classes.

• 17 is a special value meaning at least two of the four character classes.

The default setting is 15.

nsslapd-pluginarg1, which takes the absolute file system path to an ASCII dictionary file. If the argument is missing, the dictionary check is skipped. The plug-in does not initialize and Directory Server does not start if the value of this attribute is invalid or refers to an inaccessible file.

Default settings

off

Dependencies

Default password file, install-path/resources/plugins/words-english-big.txt

POSTAL ADDRESS STRING SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Postal Address Syntax

DN of Configuration Entry

cn=Postal Address Syntax,cn=plugins,cn=config

Description

Syntax used for handling postal addresses.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

PTA PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Pass Through Authentication

DN of Configuration Entry

cn=Pass Through Authentication,cn=plugins, cn=config

Description

Enables pass-through authentication, the mechanism that allows one directory to consult another to authenticate bind requests.

Configurable Options

on | off

Default Setting

off

Configurable Arguments

The LDAP URL to the configuration directory.

nsslapd-pluginarg0: ldap://config.example.com/o=example

Dependencies

None

REFERENTIAL INTEGRITY POSTOPERATION PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Referential Integrity Postoperation

DN of Configuration Entry

cn=Referential Integrity Postoperation, cn=plugins,cn=config

Description

Enables the server to ensure referential integrity.

All attributes in all databases that are used by the referential integrity plug-in must be indexed. The indexes need to be created in the configuration of all the databases. When the retro change log is enabled, the cn=changelog suffix must be indexed.

Configurable Options

All configuration and on | off

Default Setting

off

Configurable Arguments

When enabled, the post operation Referential Integrity plug-in performs integrity updates on the member, uniquemember, owner, and seeAlso attributes immediately after a delete or rename operation. You can reconfigure the plug-in to perform integrity checks on all other attributes.

The following arguments are configurable:

1. (nsslapd-pluginarg0) Check for referential integrity

   -1 = no check for referential integrity

   0 = check for referential integrity is performed immediately

   positive integer = request for referential integrity is queued and processed at a later stage. This positive integer serves as a wake-up call for the thread to process the request, at intervals corresponding to the integer specified.

2. (nsslapd-pluginarg1) Log file for storing the change, for example /local/dsInst/logs/referint

3. (nsslapd-pluginarg2) Reserved for future use.

4. (Other nsslapd-pluginarg* attributes) Attribute names to be checked for referential integrity.

Dependencies

database type

Tuning Recommendations

Do the following when you use the referential integrity plug-in in a multi-master replication environment:

• Enable the referential integrity plug-in on all servers containing master replicas

• Enable the referential integrity plug-in with the same configuration on every master

Set the first argument to a positive value, such as 10, meaning ten seconds, to ensure that work performed by this plug-in happens asynchronously, rather than synchronously.

When enabling the plug-in, also create equality indexes for all attributes configured for use with the plug-in. The plug-in uses such indexes when searching for entries to update. Without equality indexes for the attributes it uses, the plug-in must perform costly unindexed searches that have negative impact on performance.

RETRO CHANGE LOG PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Retro Changelog Plugin

DN of Configuration Entry

cn=Retro Changelog Plugin,cn=plugins,cn=config

Description

Used by LDAP clients for maintaining application compatibility with Directory Server 4.x versions.

Maintains a log of all changes occurring in Directory Server. The retro change log offers the same functionality as the changelog in the 4.x versions of Directory Server.

Configurable Options

on | off

Default Setting

off

Configurable Arguments

The following arguments can be configured for the retro change log plug-in:

• nsslapd-pluginarg0: -ignore_attributesconfigures the retro change log plug-in to ignore attributes specified by the following nsslapd-pluginarg. This argument is configured by default.

• nsslapd-pluginarg1: copyingFromspecifies a list of attributes to be ignored by the preceding nsslapd-pluginarg. This argument is configured by default.

• nsslapd-pluginarg2: suffixes="suffix1","suffix2" configures the retro change log to record updates to specified suffixes only

• nsslapd-pluginarg3: deletedEntryAttributes=attribute1,attribute2 configures the retro change log to record specified attributes of an entry when that entry is deleted

Dependencies

None

Performance Related Information

May slow down Directory Server performance.

Example Configuration

dn: cn=Retro Changelog Plugin,cn=plugins,cn=config
objectClass: top
objectClass: nsSlapdPlugin
objectClass: ds-signedPlugin
objectClass: extensibleObject
cn: Retro Changelog Plugin
nsslapd-pluginPath: /opt/SUNWdsee7/lib/sparcv9/retrocl-plugin.so
nsslapd-pluginInitfunc: retrocl_plugin_init
nsslapd-pluginType: object
nsslapd-plugin-depends-on-type: database
nsslapd-pluginarg0: -ignore_attributes
nsslapd-pluginarg1: copyingFrom
nsslapd-pluginarg2: suffixes="ou=people","dc=example","dc=com"
nsslapd-pluginarg3: deletedEntryAtrributes="objectclass","employeenumber"
nsslapd-changelogdir: /local/dsInst/db/changelog
nsslapd-pluginEnabled: on
nsslapd-pluginId: retrocl
nsslapd-pluginVersion: 11.1.1.3.0
nsslapd-pluginVendor: Sun Microsystems, Inc.
nsslapd-pluginDescription: Retrocl Plugin
ds-pluginSignatureState: valid signature

ROLES PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Roles Plugin

DN of Configuration Entry

cn=Roles Plugin,cn=plugins,cn=config

Description

Enables the use of roles in Directory Server.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

State Change Plugin

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

STATE CHANGE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

State Change Plugin

DN of Configuration Entry

cn=State Change Plugin,cn=plugins,cn=config

Description

State change notification service plug-in for detecting updates, such as configuration changes, and triggering callbacks when updates happen.

This plug-in is used internally by the roles plug-in.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

SUBTREE ENTRY COUNTER PLUG-INS

Consider the following aspects of this plug-in.

Plug-In Name

Subtree Entry Counter For ObjectClass

DN of Configuration Entry

cn=Subtree Entry Counter for ObjectClass,cn=plugins, cn=config

Description

Maintain a count of entries with a particular object class. The following plug-ins are provided.

• Subtree entry counter for departments in domains

• Subtree entry counter for domains within a domain

• Subtree entry counter for mail lists

• Subtree entry counter for nested departments

• Subtree entry counter for total domains

• Subtree entry counter for users

Configurable Options

on | off

Default Setting

off

Configurable Arguments

None

Dependencies

None

Performance Related Information

These plug-ins are provided for use with Messaging Server only, and are disabled by default. Leave these plug-ins disabled unless your Messaging Server requires them.

Counter Attributes Maintained

nsNumDepts

Either the number of departments within a domain, or the number of departments within a department (nested departments), depending on the DN of the entry.

nsNumDomains

Either the number of total domains, or the number of domains within a domain or nested domain, depending on the DN of the entry.

nsNumMailLists

Number of mail lists.

TELEPHONE SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Telephone Syntax

DN of Configuration Entry

cn=Telephone Syntax,cn=plugins,cn=config

Description

Syntax for handling telephone numbers.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

UID UNIQUENESS PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

UID Uniqueness

DN of Configuration Entry

cn=UID Uniqueness,cn=plugins,cn=config

Description

Checks that the values of specified attributes are unique each time a modification occurs on an entry.

Configurable Options

on | off

Default Setting

off

Configurable Arguments

You may configure this plug-in in either of two different ways.

1. Specify attributes that must be unique for a series of one or more subtrees identified by DNs. For example, to specify that employeeNumber and uid attribute values must be unique across both o=org1,dc=example,dc=com and o=org2,dc=example,dc=com , configure the arguments in the configuration entry as follows:

   nsslapd-pluginarg0: employeeNumber
   nsslapd-pluginarg1: uid
   nsslapd-pluginarg2: o=org1,dc=example,dc=com
   nsslapd-pluginarg3: o=org2,dc=example,dc=com

2. You specify attributes that must be unique inside congruent subtrees, optionally only on entries of a specified object class. For example, to specify that employeeNumber and uid attribute values must be unique in either o=org1,dc=example,dc=com or o=org2,dc=example,dc=com, but only on entries of the inetOrgPerson object class, configure the arguments in the configuration entry as follows:

   nsslapd-pluginarg0: employeeNumber
   nsslapd-pluginarg1: uid
   nsslapd-pluginarg2: MarkerObjectClass="organization"
    RequiredObjectClass="inetOrgPerson"

Dependencies

database type

Performance Related Information

Directory Server provides the UID Uniqueness plug-in by default. To ensure unique values for other attributes, you can create instances of the UID Uniqueness plug-in for those attributes.

The UID Uniqueness plug-in may slow down Directory Server performance.

URI PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

URI Syntax

DN of Configuration Entry

cn=URI Syntax,cn=plugins,cn=config

Description

Syntax for handling URIs (Unique Resource Identifiers) including URLs (Unique Resource Locators.)

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised June 2010

Name | Description | Attributes | See Also

nsslapd-pluginVersion(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-plugin, nsslapd-plugin-depends-on-named, nsslapd-plugin-depends-on-type, nsslapd-pluginDescription, nsslapd-pluginEnabled, nsslapd-pluginId, nsslapd-pluginInitfunc, nsslapd-pluginPath, nsslapd-pluginType, nsslapd-pluginVendor, nsslapd-pluginVersion – Directory Server plug-in legacy configuration

Description

The nsslapd-plugin attribute on cn=config is multi-valued, read-only attribute lists the syntaxes and matching rules loaded by the server. This manual page covers server plug-in configuration, rather than the nsslapd-plugin attribute.

This manual page provides an overview of legacy configuration information for server plug-ins. This manual page covers the individual plug-in configuration entry attributes. Also, this manual page covers the plug-ins provided with Directory Server, including configurable options, configurable arguments, default setting, dependencies, general performance related information, and further reading.

---

Note –

In most circumstances, you configure plug-in functionality using the dsconf(1M) command. See plugin(5dsconf) for a list of configurable properties.

---

ATTRIBUTES FOR PLUG-IN CONFIGURATION ENTRIES

The following list covers each plug-in configuration entry attribute.

nsslapd-plugin-depends-on-named

This is a multivalued attribute, used to ensure that plug-ins are called by the server in the correct order. It takes a value that corresponds to the cn value of a plug-in. The plug-in whose cn value matches one of the values below it is started by the server prior to this plug-in. If the plug-in does not exist, the server fails to start.

Entry DN

cn=pluginName,cn=plugins, cn=config

Valid Range

Plug-in name

Default Value

None

Syntax

DirectoryString

Example

nsslapd-plugin-depends-on-named: Class of Service

nsslapd-plugin-depends-on-type

This is a multivalued attribute, used to ensure that plug-ins are called by the server in the correct order. It takes a value that corresponds to the type of a plug-in, contained in the attribute nsslapd-pluginType, and requires that plug-ins of that type are started before the present plug-in.

Entry DN

cn=pluginName,cn=plugins, cn=config

Valid Range

Plug-in type

Default Value

None

Syntax

DirectoryString

Example

nsslapd-plugin-depends-on-type: database

nsslapd-pluginDescription

Provides a description of the plug-in.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any DirectoryString

Default Value

None

Syntax

DirectoryString

Example

nsslapd-pluginDescription: acl access check plug-in

nsslapd-pluginEnabled

Specifies whether or not the plug-in is enabled. This attribute can be changed over protocol, but will only take effect when the server is next restarted.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

on | off

Default Value

on

Syntax

DirectoryString

Example

nsslapd-pluginEnabled: on

nsslapd-pluginId

Specifies the plug-in ID.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any valid plug-in ID.

Default Value

None

Syntax

DirectoryString

Example

nsslapd-pluginId: chaining database

nsslapd-pluginInitfunc

Specifies the plug-in function to be initiated.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any valid plug-in function.

Default Value

None

Syntax

DirectoryString

Example

nsslapd-pluginInitfunc: NS7bitAttr_Init

nsslapd-pluginPath

Specifies the full path to the plug-in.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any valid path

Default Value

None

Syntax

DirectoryString

Example

nsslapd-pluginPath: /opt/SUNWdsee7/lib/sparcv9/uid-plugin.so

nsslapd-pluginType

Specifies the plug-in type.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any valid plug-in type.

Default Value

None

Syntax

DirectoryString

Example

nsslapd-pluginType: preoperation

nsslapd-pluginVendor

Specifies the vendor of the plug-in.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any approved plug-in vendor.

Default Value

Sun Microsystems, Inc.

Syntax

DirectoryString

Example

nsslapd-pluginVendor: Sun Microsystems, Inc.

nsslapd-pluginVersion

Specifies the plug-in version.

Entry DN

cn=pluginName,cn=plugins,cn=config

Valid Range

Any valid plug-in version.

Default Value

Product version

Syntax

DirectoryString

Example

nsslapd-pluginVersion: 11.1.1.3.0

7-BIT CHECK PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

7-Bit Check (NS7bitAttr)

DN of Configuration Entry

cn=7-bit check,cn=plugins,cn=config

Description

Checks certain attributes are seven-bit clean.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

List of attributes, uid mail userpassword, followed by a comma, and then by the suffix or suffixes on which the check is to occur.

Dependencies

None

Performance Related Information

None

Further Information

If your Directory Server uses non-ASCII characters such as Japanese and other languages for some attributes, remove those attributes from the list of attributes checked by this plug-in.

When adding or modifying an attribute value checked by this plug-in, and the new value violates the seven-bit check, the client receives a LDAP_CONSTRAINT_VIOLATION (19) return code, and a message such as the following: Value of attribute attr contains extended (8-bit) characters: value

ACL PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

ACL Plugin

DN of Configuration Entry

cn=ACL Plugin,cn=plugins,cn=config

Description

ACL access check plug-in

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Leave this plug-in running at all times.

ACL PREOPERATION PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

ACL preoperation

DN of Configuration Entry

cn=ACL preoperation,cn=plugins,cn=config

Description

ACL access check plug-in.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

Database

Performance Related Information

Leave this plug-in running at all times.

BINARY SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Binary Syntax

DN of Configuration Entry

cn=Binary Syntax,cn=plugins,cn=config

Description

Syntax for handling binary data.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

BOOLEAN SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Boolean Syntax

DN of Configuration Entry

cn=Boolean Syntax,cn=plugins,cn=config

Description

Syntax for handling booleans.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CASE EXACT STRING SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Case Exact String Syntax

DN of Configuration Entry

cn=Case Exact String Syntax,cn=plugins,cn=config

Description

Syntax for handling case-sensitive strings.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CASE IGNORE STRING SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Case Ignore String Syntax

DN of Configuration Entry

cn=Case Ignore String Syntax,cn=plugins,cn=config

Description

Syntax for handling case-insensitive strings.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CHAINING DATABASE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Chaining Database

DN of Configuration Entry

cn=Chaining database,cn=plugins,cn=config

Description

Syntax for handling DNs.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CLASS OF SERVICE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Class of Service

DN of Configuration Entry

cn=Class of Service,cn=plugins,cn=config

Description

Allows for sharing of attributes between entries.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

Set the nsslapd-pluginarg0 attribute to:

• 0 (default) to enable fast lookup of classic CoS templates

• 1 to disable fast lookup for classic CoS template selection

• 2 to disable checks for ambiguous pointer and classic CoS definitions

  Ambiguous definitions result when more than one value could be returned for the same attribute of the same entry. When checking remains enabled, Directory Server logs an informational message upon encountering such an ambiguity, provided you have set the log level to allow plug-ins to log informational messages.

• 3 to disable both

Restart Directory Server for modifications to take effect.

Dependencies

None

Performance Related Information

Leave this plug-in running at all times.

COUNTRY STRING SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Country String Syntax

DN of Configuration Entry

cn=Country String Syntax,cn=plugins,cn=config

Description

Syntax for handling countries.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

DISTINGUISHED NAME SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Distinguished Name Syntax

DN of Configuration Entry

cn=Distinguished Name Syntax,cn=plugins,cn=config

Description

Syntax for handling DNs.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

DSML FRONTEND SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Frontend

DN of Configuration Entry

cn=DSMLv2-SOAP-HTTP,cn=frontends,cn=plugins, cn=config

Description

Enables you to access the directory using DSML v2 over SOAP/HTTP.

Configurable Options

on | off

Default Setting

off

Configurable Arguments

ds-hdsml-soapschemalocation

ds-hdsml-dsmlschemalocation

Dependencies

None

Performance Related Information

None

GENERALIZED TIME SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Generalized Time Syntax

DN of Configuration Entry

cn=Generalized Time Syntax,cn=plugins,cn=config

Description

Syntax for dealing with dates, times, and time zones.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

Further Information

The Generalized Time String consists of the four digit year, two digit month (for example, 01 for January), two digit day, two digit hour, two digit minute, two digit second, an optional decimal part of a second and a time zone indication. We strongly recommend that you use the Z time zone indication (Greenwich Mean Time).

INTEGER SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Integer Syntax

DN of Configuration Entry

cn=Integer Syntax,cn=plugins,cn=config

Description

Syntax for handling integers.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

INTERNATIONALIZATION PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Internationalization Plugin

DN of Configuration Entry

cn=Internationalization Plugin,cn=plugins,cn=config

Description

Syntax for handling DNs.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None. In contrast to previous versions of Directory Server, the collation orders and locales used by the internationalization plug-in are now stored in the configuration.

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

LDBM DATABASE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

ldbm database plug-in

DN of Configuration Entry

cn=ldbm database plug-in,cn=plugins,cn=config

Description

Implements local databases.

Configurable Options

None

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Leave this plug-in running at all times.

MULTIMASTER REPLICATION PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Multimaster Replication Plugin

DN of Configuration Entry

cn=Multimaster Replication plugin,cn=plugins, cn=config

Description

Enables replication between two Directory Server suffixes.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

database

Performance Related Information

None

Further Information

You can turn this plug-in off if you have only one server, which will never replicate.

OCTET STRING SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Octet String Syntax

DN of Configuration Entry

cn=Octet String Syntax,cn=plugins,cn=config

Description

Syntax for handling octet strings.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CLEAR PASSWORD STORAGE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

CLEAR

DN of Configuration Entry

cn=CLEAR,cn=Password Storage Schemes,cn=plugins, cn=config

Description

CLEAR password storage scheme used for password encryption.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

CRYPT PASSWORD STORAGE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

CRYPT

DN of Configuration Entry

cn=CRYPT,cn=Password Storage Schemes,cn=plugins, cn=config

Description

CRYPT password storage scheme used for password encryption.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

NS-MTA-MD5 PASSWORD STORAGE SCHEME PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

NS-MTA-MD5

DN of Configuration Entry

cn=NS-MTA-MD5,cn=Password Storage Schemes, cn=plugins,cn=config

Description

NS-MTA-MD5 password storage scheme for password encryption.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

Further Information

You can no longer choose to encrypt passwords using the NS-MTA-MD5 password storage scheme. The storage scheme is still present, but for backward compatibility only. The data in your directory still contains passwords encrypted with the NS-MTA-MD5 password storage scheme.

RMCE PASSWORD STORAGE SCHEME PLUG-IN

This password storage scheme plug-in is used for example by the administration framework and is reserved for internal use.

SHA PASSWORD STORAGE SCHEME PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

SHA

DN of Configuration Entry

cn=SHA,cn=Password Storage Schemes,cn=plugins, cn=config

Description

SHA password storage scheme for password encryption.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

If there are no passwords encrypted using the SHA password storage scheme, you may turn this plug-in off. If you want to encrypt your password with the SHA password storage scheme, choose SSHA instead. SSHA is a far more secure option.

SSHA PASSWORD STORAGE SCHEME PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

SSHA

DN of Configuration Entry

cn=SSHA,cn=Password Storage Schemes,cn=plugins, cn=config

Description

SSHA password storage scheme for password encryption.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

STRONG PASSWORD CHECK PLUG-IN

When Directory Server is configured to check password quality, and this plug-in is enabled, the plug-in checks the following each time a password is added or modified.

• Clear text password values contain the classes of characters specified by the configuration.

• Clear text password values do not contain any sequence of four characters present in the dictionary file specified by the configuration.

Hashed password values such as {SSHA}0Ri1g2yqlH3GTZcuRQ4uS22syCQLBKAU2ypLSw== are not checked.

Consider the following aspects of this plug-in.

Plug-In Name

Strong Password Checking plug-in

DN of Configuration Entry

cn=Strong Password Check,cn=plugins,cn=config

Configurable options and arguments

on | off

nsslapd-pluginarg0, which takes an integer representing a mask of values representing the character classes that must be present in a valid password. Set nsslapd-pluginarg0 to one of or a sum of the following values, not counting the special values 16 and 17.

• 1 means the password must contain special characters.

• 2 means the password must contain numeric characters.

• 4 means the password must contain upper case characters.

• 8 means the password must contain lower case characters.

• 16 is a special value meaning at least three of the four character classes.

• 17 is a special value meaning at least two of the four character classes.

The default setting is 15.

nsslapd-pluginarg1, which takes the absolute file system path to an ASCII dictionary file. If the argument is missing, the dictionary check is skipped. The plug-in does not initialize and Directory Server does not start if the value of this attribute is invalid or refers to an inaccessible file.

Default settings

off

Dependencies

Default password file, install-path/resources/plugins/words-english-big.txt

POSTAL ADDRESS STRING SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Postal Address Syntax

DN of Configuration Entry

cn=Postal Address Syntax,cn=plugins,cn=config

Description

Syntax used for handling postal addresses.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

PTA PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Pass Through Authentication

DN of Configuration Entry

cn=Pass Through Authentication,cn=plugins, cn=config

Description

Enables pass-through authentication, the mechanism that allows one directory to consult another to authenticate bind requests.

Configurable Options

on | off

Default Setting

off

Configurable Arguments

The LDAP URL to the configuration directory.

nsslapd-pluginarg0: ldap://config.example.com/o=example

Dependencies

None

REFERENTIAL INTEGRITY POSTOPERATION PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Referential Integrity Postoperation

DN of Configuration Entry

cn=Referential Integrity Postoperation, cn=plugins,cn=config

Description

Enables the server to ensure referential integrity.

All attributes in all databases that are used by the referential integrity plug-in must be indexed. The indexes need to be created in the configuration of all the databases. When the retro change log is enabled, the cn=changelog suffix must be indexed.

Configurable Options

All configuration and on | off

Default Setting

off

Configurable Arguments

When enabled, the post operation Referential Integrity plug-in performs integrity updates on the member, uniquemember, owner, and seeAlso attributes immediately after a delete or rename operation. You can reconfigure the plug-in to perform integrity checks on all other attributes.

The following arguments are configurable:

1. (nsslapd-pluginarg0) Check for referential integrity

   -1 = no check for referential integrity

   0 = check for referential integrity is performed immediately

   positive integer = request for referential integrity is queued and processed at a later stage. This positive integer serves as a wake-up call for the thread to process the request, at intervals corresponding to the integer specified.

2. (nsslapd-pluginarg1) Log file for storing the change, for example /local/dsInst/logs/referint

3. (nsslapd-pluginarg2) Reserved for future use.

4. (Other nsslapd-pluginarg* attributes) Attribute names to be checked for referential integrity.

Dependencies

database type

Tuning Recommendations

Do the following when you use the referential integrity plug-in in a multi-master replication environment:

• Enable the referential integrity plug-in on all servers containing master replicas

• Enable the referential integrity plug-in with the same configuration on every master

Set the first argument to a positive value, such as 10, meaning ten seconds, to ensure that work performed by this plug-in happens asynchronously, rather than synchronously.

When enabling the plug-in, also create equality indexes for all attributes configured for use with the plug-in. The plug-in uses such indexes when searching for entries to update. Without equality indexes for the attributes it uses, the plug-in must perform costly unindexed searches that have negative impact on performance.

RETRO CHANGE LOG PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Retro Changelog Plugin

DN of Configuration Entry

cn=Retro Changelog Plugin,cn=plugins,cn=config

Description

Used by LDAP clients for maintaining application compatibility with Directory Server 4.x versions.

Maintains a log of all changes occurring in Directory Server. The retro change log offers the same functionality as the changelog in the 4.x versions of Directory Server.

Configurable Options

on | off

Default Setting

off

Configurable Arguments

The following arguments can be configured for the retro change log plug-in:

• nsslapd-pluginarg0: -ignore_attributesconfigures the retro change log plug-in to ignore attributes specified by the following nsslapd-pluginarg. This argument is configured by default.

• nsslapd-pluginarg1: copyingFromspecifies a list of attributes to be ignored by the preceding nsslapd-pluginarg. This argument is configured by default.

• nsslapd-pluginarg2: suffixes="suffix1","suffix2" configures the retro change log to record updates to specified suffixes only

• nsslapd-pluginarg3: deletedEntryAttributes=attribute1,attribute2 configures the retro change log to record specified attributes of an entry when that entry is deleted

Dependencies

None

Performance Related Information

May slow down Directory Server performance.

Example Configuration

dn: cn=Retro Changelog Plugin,cn=plugins,cn=config
objectClass: top
objectClass: nsSlapdPlugin
objectClass: ds-signedPlugin
objectClass: extensibleObject
cn: Retro Changelog Plugin
nsslapd-pluginPath: /opt/SUNWdsee7/lib/sparcv9/retrocl-plugin.so
nsslapd-pluginInitfunc: retrocl_plugin_init
nsslapd-pluginType: object
nsslapd-plugin-depends-on-type: database
nsslapd-pluginarg0: -ignore_attributes
nsslapd-pluginarg1: copyingFrom
nsslapd-pluginarg2: suffixes="ou=people","dc=example","dc=com"
nsslapd-pluginarg3: deletedEntryAtrributes="objectclass","employeenumber"
nsslapd-changelogdir: /local/dsInst/db/changelog
nsslapd-pluginEnabled: on
nsslapd-pluginId: retrocl
nsslapd-pluginVersion: 11.1.1.3.0
nsslapd-pluginVendor: Sun Microsystems, Inc.
nsslapd-pluginDescription: Retrocl Plugin
ds-pluginSignatureState: valid signature

ROLES PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Roles Plugin

DN of Configuration Entry

cn=Roles Plugin,cn=plugins,cn=config

Description

Enables the use of roles in Directory Server.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

State Change Plugin

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

STATE CHANGE PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

State Change Plugin

DN of Configuration Entry

cn=State Change Plugin,cn=plugins,cn=config

Description

State change notification service plug-in for detecting updates, such as configuration changes, and triggering callbacks when updates happen.

This plug-in is used internally by the roles plug-in.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

SUBTREE ENTRY COUNTER PLUG-INS

Consider the following aspects of this plug-in.

Plug-In Name

Subtree Entry Counter For ObjectClass

DN of Configuration Entry

cn=Subtree Entry Counter for ObjectClass,cn=plugins, cn=config

Description

Maintain a count of entries with a particular object class. The following plug-ins are provided.

• Subtree entry counter for departments in domains

• Subtree entry counter for domains within a domain

• Subtree entry counter for mail lists

• Subtree entry counter for nested departments

• Subtree entry counter for total domains

• Subtree entry counter for users

Configurable Options

on | off

Default Setting

off

Configurable Arguments

None

Dependencies

None

Performance Related Information

These plug-ins are provided for use with Messaging Server only, and are disabled by default. Leave these plug-ins disabled unless your Messaging Server requires them.

Counter Attributes Maintained

nsNumDepts

Either the number of departments within a domain, or the number of departments within a department (nested departments), depending on the DN of the entry.

nsNumDomains

Either the number of total domains, or the number of domains within a domain or nested domain, depending on the DN of the entry.

nsNumMailLists

Number of mail lists.

TELEPHONE SYNTAX PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

Telephone Syntax

DN of Configuration Entry

cn=Telephone Syntax,cn=plugins,cn=config

Description

Syntax for handling telephone numbers.

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

UID UNIQUENESS PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

UID Uniqueness

DN of Configuration Entry

cn=UID Uniqueness,cn=plugins,cn=config

Description

Checks that the values of specified attributes are unique each time a modification occurs on an entry.

Configurable Options

on | off

Default Setting

off

Configurable Arguments

You may configure this plug-in in either of two different ways.

1. Specify attributes that must be unique for a series of one or more subtrees identified by DNs. For example, to specify that employeeNumber and uid attribute values must be unique across both o=org1,dc=example,dc=com and o=org2,dc=example,dc=com , configure the arguments in the configuration entry as follows:

   nsslapd-pluginarg0: employeeNumber
   nsslapd-pluginarg1: uid
   nsslapd-pluginarg2: o=org1,dc=example,dc=com
   nsslapd-pluginarg3: o=org2,dc=example,dc=com

2. You specify attributes that must be unique inside congruent subtrees, optionally only on entries of a specified object class. For example, to specify that employeeNumber and uid attribute values must be unique in either o=org1,dc=example,dc=com or o=org2,dc=example,dc=com, but only on entries of the inetOrgPerson object class, configure the arguments in the configuration entry as follows:

   nsslapd-pluginarg0: employeeNumber
   nsslapd-pluginarg1: uid
   nsslapd-pluginarg2: MarkerObjectClass="organization"
    RequiredObjectClass="inetOrgPerson"

Dependencies

database type

Performance Related Information

Directory Server provides the UID Uniqueness plug-in by default. To ensure unique values for other attributes, you can create instances of the UID Uniqueness plug-in for those attributes.

The UID Uniqueness plug-in may slow down Directory Server performance.

URI PLUG-IN

Consider the following aspects of this plug-in.

Plug-In Name

URI Syntax

DN of Configuration Entry

cn=URI Syntax,cn=plugins,cn=config

Description

Syntax for handling URIs (Unique Resource Identifiers) including URLs (Unique Resource Locators.)

Configurable Options

on | off

Default Setting

on

Configurable Arguments

None

Dependencies

None

Performance Related Information

Do not modify the configuration of this plug-in. Leave this plug-in running at all times.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised June 2010

Name | Description | Attributes | See Also

nsslapd-port(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-port – LDAP port number

Description

TCP/IP port number used for LDAP communications. If you want to run SSL/TLS over this port, you can do so through the Start TLS extended operation. This selected port must be unique on the host system; make sure no other application is attempting to use the same port number. Specifying a port number of less than 1024 requires Directory Server to run as super user.

---

Note –

Be aware when changing this port number of other applications whose configurations you may have to modify to reflect the change.

---

You must restart the server for the port number change to be taken into account.

Entry DN

cn=config

Valid Range

1 to 65535

Default Value

389

Syntax

Integer

Example

nsslapd-port: 389

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 5, 2006

Name | Description | Attributes | See Also

nsslapd-privatenamespaces(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-privatenamespaces – private naming contexts

Description

Contains the list of the private naming contexts cn=config, cn=schema, and cn=monitor.

Entry DN

cn=config

Valid Range

cn=config, cn=schema, and cn=monitor

Default Value

N/A

Syntax

DirectoryString

Example

nsslapd-privatenamespaces: cn=config

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 5, 2006

Name | Description | Attributes | See Also

nsslapd-pwdgeneratorpwdlen(5dsconf)

Name | Description | Examples | Attributes

Name

nsslapd-pwdgeneratorpwdlen – Generated password length

Description

PROPERTY	VALUE
Entry DN	cn=config
Valid Range	6 to 512
Default Value	6
Syntax	Integer

This attribute specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Examples

nsslapd-pwdgeneratorpwdlen: 8

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Examples | Attributes

nsslapd-readonly(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-readonly – read only mode

Description

Specifies whether the whole server, or an individual database, is in read-only mode, meaning that neither data in a database nor configuration information can be modified. Any attempt to modify a database in read-only mode returns an error indicating that the server is unwilling to perform the operation.

Entry DN

cn=config

cn=dbName,cn=ldbm database,cn=plugins,cn=config

Valid Range

on | off

Default Value

off

Syntax

DirectoryString

Example

nsslapd-readonly: off

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 5, 2006

Name | Description | Attributes | See Also

nsslapd-referral(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-referral – referral

Description

This multivalued attribute specifies the LDAP URL or URLs to be returned by the suffix, when the server receives a request for an entry not belonging to the local tree, that is, an entry whose suffix does not match the value specified on any of the suffix attributes. For example, suppose the database contains only the entries under the following DN.

ou=People, dc=example,dc=com

Yet, the request is for an entry under the following DN.

ou=Groups, dc=example,dc=com

In this case, the referral is returned so the client may contact the corresponding directory for the requested entry. Although only one referral is allowed per Directory Server instance, this referral can have multiple values.

---

Note –

If you want to use SSL and TLS communications, the referral attribute should be of the following form.

ldaps://hostname

Start TLS does not support referrals.

---

For suffix configuration entries, this attribute is required when the value of the nsslapd-state attribute is set to referral.

Entry DNs

cn=config

cn="suffixName",cn=mapping tree,cn=config

Valid Range

Valid LDAP URL in the following format: ldap:// hostname

Default Value

Not applicable

Syntax

DirectoryString

Example

nsslapd-referral: ldap://alternate.example.com

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 6, 2006

Name | Description | Attributes | See Also

nsslapd-referralmode(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-referralmode – referral mode

Description

When set, this attribute causes the server send back the referral for any request on any suffix.

Entry DN

cn=config

Valid Range

Valid LDAP URL in the following format: ldap:// serverHost

Default Value

Not applicable

Syntax

DirectoryString

Example

nsslapd-referralmode: ldap://backup.example.com

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 5, 2006

Name | Description | Attributes | See Also

nsslapd-require-index(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-require-index – allow only indexed searches

Description

When switched to on, this attribute allows you to refuse unindexed searches. This performance related attribute avoids saturating the server with erroneous searches.

Entry DN

cn=dbname,cn=ldbm database,cn=plugins,cn=config

Valid Range

on | off

Default Value

off

Syntax

DirectoryString

Example

nsslapd-require-index: off

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 6, 2006

Name | Description | Attributes | See Also

nsslapd-reservedescriptors(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-reservedescriptors – reserve file descriptors

Description

This read-only attribute specifies the number of file descriptors that Directory Server reserves for managing non-client connections, such as index management and managing replication. The number of file descriptors that the server reserves for this purpose subtracts from the total number of file descriptors available for servicing LDAP client connections.

Most installations of Directory Server should never need to change this attribute. However, consider increasing the value on this attribute if all of the following are true:

• The server is replicating to a large number of consumer servers (more than 10), or the server is maintaining a large number of index files (more than 30).

• The server is servicing a large number of LDAP connections.

• You get error messages reporting that the server is unable to open file descriptors (the actual error message will differ depending on the operation that the server is attempting to perform), but these error messages are NOT related to managing client LDAP connections.

  Increasing the value on this attribute may result in more LDAP clients being unable to access your directory. Therefore, when you increase the value on this attribute, increase the value on the nsslapd-maxdescriptors attribute also. Note that you may not be able to increase the nsslapd-maxdescriptors value if your server is already using the maximum number of file descriptors that your operating system allows a process to use. Refer to your operating system documentation for details. If this is the case, then reduce the load on your server by causing LDAP clients to search alternative directory replicas.

  To assist you in computing the number of file descriptors you set for this attribute, use the following formula:

  nsslapd-reservedescriptor =
  20 +
  (NumBackends * 4) +
  NumGlobalIndexes  +
  ReplicationDescriptors +
  ChainingBackendDescriptors +
  PTADescriptors +
  SSLDescriptors
  

  The terms in the formula are as follows.

  NumldbmBackends

  Number of LDBM databases.

  NumGlobalIndexes

  Total number of configured indexes for all databases including system indexes. By default, there are 8 system indexes and 17 additional indexes per database.

  ReplicationDescriptors

  NumSupplierReplicas + 8

  Where NumSupplierReplicas is number of replicas in the server that can act as a supplier (hub or master).

  ChainingBackendDescriptors

  NumChainingBackends * nsOperationConnectionsLimit

  Where nsOperationConnectionsLimit is defined in the chained suffix configuration and 10 by default.

  PTADescriptors

  3 if PTA is configured, 0 if PTA is not configured.

  SSLDescriptors

  5 (4 files + 1 listen socket) if SSL is configured, 0 if SSL is not configured.

Entry DN

cn=config

Valid Range

1 to 65535

Default Value

64

Syntax

Integer

Example

nsslapd-reservedescriptors: 64

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 5, 2006

Name | Description | Attributes | See Also

nsslapd-return-exact-case(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-return-exact-case – return exact case

Description

Returns the exact case of attribute names, as defined in the schema.

Attribute names are case-insensitive by default. However, when an attribute is returned by Directory Server. as the result of a search operation, some client applications require attribute names to match the case of the attribute as it is listed in the schema. Other client applications require attribute names to be returned in lower case.

nsslapd-return-exact-case is enabled by default. You should disable this attribute if you have legacy clients that expect attribute names to be returned in lower case for backward compatibility with Directory Server 4.x. You must stop and restart the server for changes to this attribute to be taken into account.

Note that if the attribute name is specified in the search, it is returned in the case in which it is specified, regardless of the value of nsslapd-return-exact-case.

For example, the following search command:

ldapsearch -b "cn=config" -s base objectclass=* "PassWordMinAGe"

Returns the attribute as PassWordMinAGe=0, whether nsslapd-return-exact-case is set to on or off.

If nsslapd-return-exact-case is set to on, the following search command:

ldapsearch -b "cn=config" -s base objectclass=*

Returns the attribute as passwordMinAge=0, which is how this attribute is defined in the schema.

If nsslapd-return-exact-case is set to off, the same search command:

ldapsearch -b "cn=config" -s base objectclass=*

Returns the attribute as passwordminage=0, in lower case.

Entry DN

cn=config

Valid Range

on | off

Default Value

on

Syntax

DirectoryString

Example

nsslapd-return-exact-case: on

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 5, 2006

Name | Description | Attributes | See Also

nsslapd-rootdn(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-rootdn – Directory Manager DN

Description

Specifies the distinguished name of an entry that is not subject to access control restrictions, administrative limit restrictions for operations on the directory or resource limits in general. The attributes nsslapd-sizelimit, nsslapd-timelimit, and nsslapd-schemacheck do not apply to this DN either. nsslapd-idletimeout does however apply to connections opened by this DN.

Entry DN

cn=config

Valid Range

Any valid distinguished name

Default Value

cn=Directory Manager

Syntax

DN

Example

nsslapd-rootdn: cn=Directory Manager

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 5, 2006

Name | Description | Attributes | See Also

nsslapd-rootpw(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-rootpw – Directory Manager password

Description

Allows you to specify the password associated with the Directory Manager DN. When you provide the root password, it will be encrypted according to the encryption method you selected for nsslapd-rootpwstoragescheme.

When viewed from the dse.ldif file, this attribute shows the encryption method followed by the encrypted string of the password.

---

Note –

If you configure a root DN at server installation time, you must also provide a root password. However, it is possible for the root password to be deleted from dse.ldif by direct editing of the file. In this situation, the root DN can only obtain the same access to your directory as you allow for anonymous access. Always make sure that a root password is defined in dse.ldif when a root DN is configured for your database.

---

Entry DN

cn=config

Valid Range

Any valid password encrypted by any one of the encryption methods described in passwordStorageScheme(5dsat).

Default Value

Not applicable

Syntax

DirectoryString: {encryption_method}encrypted_password

Example

nsslapd-rootpw: {SSHA}fp+C/eJCYVV0ZlXDE52Pd9uOzjvJVk4B10biAg==

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 5, 2006

Name | Description | Attributes | See Also

nsslapd-rootpwstoragescheme(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-rootpwstoragescheme – root password storage scheme

Description

This attribute indicates the encryption method used for the root password.

Entry DN

cn=config

Valid Range

Any encryption method described in passwordStorageScheme(5dsat)

Default Value

SSHA

Syntax

DirectoryString

Example

nsslapd-rootpwstoragescheme: SSHA

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 5, 2006

Name | Description | Attributes | See Also

nsslapd-schemacheck(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-schemacheck – schema checking

Description

Specifies whether the database schema will be enforced during entry insertion or modification. When this attribute has a value of on, Directory Server will not check the schema of existing entries until they are modified. The database schema defines the type of information allowed in the database. You can extend the default schema using the objectclasses and attribute types.

---

Note –

Schema checking works by default when database modifications are made using an LDAP client, such as ldapmodify, the Directory Server console, or when importing a database from LDIF.

If you turn schema checking off, you will have to verify manually that your entries conform to the schema. If schema checking is turned on, the server sends an error message to inform you of the entries that do not match the schema. Make sure that the attributes and object classes you create in your LDIF statements are both spelled correctly and identified in dse.ldif. You will need to create a file in LDIF format in the schema directory or add the elements to 99user.ldif.

---

Entry DN

cn=config

Valid Range

on | off

Default Value

on

Syntax

DirectoryString

Example

nsslapd-schemacheck: on

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 5, 2006

Name | Description | Attributes | See Also

nsslapd-schema-repl-useronly(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-schema-repl-useronly – replicate only user-defined schema elements

Description

This attribute allows you to have greater control over the schema that is replicated. The attribute is off by default, implying that the entire schema is replicated. If the attribute is set to on, only schema with an X-ORIGIN of user-defined is replicated. This setting greatly improves the performance of schema replication.

If you are replicating from a current Directory Server to a 5.1 server, you must set this attribute to on. Otherwise the current schema will be pushed to the 5.1 server and the 5.1 server will be unable to restart, due to duplicate objects.

Entry DN

cn=config

Valid Range

on | off

Default Value

off

Syntax

DirectoryString

Example

nsslapd-schema-repl-useronly: off

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 5, 2006

Name | Description | Attributes | See Also

nsslapd-search-tune(5dsconf)

Name | Description | Examples | Attributes

Name

nsslapd-search-tune – Skip check for modifications during search before returning entries

Description

PROPERTY	VALUE
Entry DN	cn=config,cn=ldbm database,cn=plugins,cn=config
Valid Range	See description that follows.
Default Value	Not defined
Syntax	Integer

This attribute specifies that Directory Server should skip the double-check it normally does to verify that search results returned include the most current version of the entry content, even if the entry has been modified during the search. This double-check verification involves testing the search filter against each entry to return in response to the search.

Allowing Directory Server to skip the filter test when the search involves complex filters and large static groups can result in significant performance improvement.

When nsslapd-search-tune is set, the access log identifies searches for which the filter test is skipped with the tag notes=F.

Set nsslapd-search-tune to a sum of the following values:

1

Enable the filter test to be skipped before the entry is returned.

2

Reserved, do not use.

4

Reserved, do not use.

8

Skip the filter test even if the attribute in the filter is in the list of requested attributes. This could potentially cause the server to return entries that no longer correspond to search criteria.

16

Skip the filter test when search filters are complex, using & and |.

32

Always finish building the list of candidate entries from the index.

Examples

nsslapd-search-tune: 49

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Examples | Attributes

nsslapd-securelistenhost(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-securelistenhost – listen to IP address for secure connections

Description

Allows multiple Directory Server instances to run on a multi-homed machine, using secure SSL/TLS connections, and makes it possible to limit listening to one or more interfaces of a multi-homed machine. Provide the hostname or host names corresponding to the IP interface or interfaces you want to specify as the values for this attribute. Directory Server responds only to requests sent to the interface or interfaces corresponding to the host name or host names specified. This prevents other programs from using the same port as Directory Server on the interfaces specified.

Entry DN

cn=config

Valid Range

Any secure host name or host names

Default Value

Not applicable

Syntax

DirectoryString

Example

nsslapd-securelistenhost: secure-hostname

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 5, 2006

Name | Description | Attributes | See Also

nsslapd-securePort(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-securePort – encrypted LDAP port number

Description

TCP/IP port number used for SSL/TLS communications. This selected port must be unique on the host system; make sure no other application is attempting to use the same port number. Specifying a port number of less than 1024 requires that Directory Server runs as super user.

---

Note –

Be aware when changing this port number of other applications whose configurations you may have to modify to reflect the change.

---

The default value 636 is only used if the server has been configured with a private key and a certificate; otherwise it does not listen on this port.

You must restart the server for the port number change to be taken into account.

Entry DN

cn=config

Valid Range

1 to 65535

Default Value

636

Syntax

Integer

Example

nsslapd-securePort: 636

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 5, 2006

Name | Description | Attributes | See Also

nsslapd-security(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-security – security

Description

Enables the use of security features, SSL/TLS and attribute encryption, in Directory Server. If you require secure connections, or the use of the attribute encryption feature, this attribute should be set to on.

Entry DN

cn=config

Valid Range

on | off

Default Value

off

Syntax

DirectoryString

Example

nsslapd-security: off

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 5, 2006

Name | Description | Attributes | See Also

nsslapd-sizelimit(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-sizelimit – size limit

Description

Specifies the maximum number of entries to return from a search operation. If this limit is reached, the server returns any entries it has located that match the search request, as well as an exceeded size limit error.

When no limit is set, the server will return every matching entry to the client regardless of the number found. To set a no limit value whereby Directory Server will wait indefinitely for the search to complete, specify a value of -1 for this attribute in the dse.ldif file.

This limit applies to everyone regardless of their organization.

Entry DN

cn=config

cn=default instance config,cn=chaining database, cn=plugins,cn=config

Valid Range

-1 to the maximum 32 bit integer value (2147483647)

Default Value

2000

Syntax

Integer

Example

nsslapd-sizelimit: 2000

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 5, 2006

Name | Description | Attributes | See Also

nsslapd-state(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-state – how a suffix handles operations

Description

Determines how the suffix handles operations.

Entry DN

cn="suffixName",cn=mapping tree,cn=config

Valid Range

backend

The backend database is used to process all operations.

disabled

The database is not available for processing operations. The server returns a “No such search object” error in response to requests made by client applications.

referral

A referral is returned for requests made to this suffix.

referral on update

The database is used for all operations except update requests, which receive a referral.

Default Value

backend

Syntax

DirectoryString

Example

nsslapd-state: backend

---

Note –

You can manually change the value of the nsslapd-state attribute. For example, you can change the value to referral or referral on update if you want the server to be read-only for the duration of a backup.

However, if replication is enabled, replication manages the value of the nsslapd-state attribute, and overwrites the value you have manually set.

---

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 6, 2006

Name | Description | Attributes | See Also

nsslapd-suffix(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-suffix – chained suffix identifier

Description

Specifies the chained suffix. This is a single-valued attribute as each database instance can have only one suffix. Previously, it was possible to have more than one suffix on a single database instance but this is no longer the case. Any changes made to this attribute after the entry has been created take effect only after you restart the server containing the chained suffix.

Entry DN

cn=dbName,cn=ldbm database,cn=plugins,cn=config

Valid Range

Any valid DN

Default Value

Not applicable

Syntax

DirectoryString

Example

nsslapd-suffix: o=example

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 6, 2006

Name | Description | Attributes | See Also

nsslapd-threadnumber(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-threadnumber – thread number

Description

Defines the number of operation threads that Directory Server creates during startup. The nsslapd-threadnumber value should be increased if you have many directory clients performing time-consuming operations such as add or modify. This ensures that there are other threads available for servicing short-lived operations such as simple searches.

Entry DN

cn=config

Valid Range

1 to the number of threads supported by your system

Default Value

30

Syntax

Integer

Example

nsslapd-threadnumber: 60

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 5, 2006

Name | Description | Attributes | See Also

nsslapd-timelimit(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-timelimit – time limit

Description

Specifies the maximum number of seconds allocated for a search request. If this limit is reached, Directory Server returns any entries it has located that match the search request, as well as an exceeded time limit error.

When no limit is set, the server returns every matching entry to the client regardless of the time it takes. To set a no limit value whereby Directory Server waits indefinitely for the search to complete, specify a value of -1 for this attribute in the dse.ldif file. A value of zero causes no time to be allowed for searches. The smallest time limit is 1 second.

Entry DN

cn=config

cn=default instance config,cn=chaining database, cn=plugins,cn=config

Valid range

-1 to the maximum 32 bit integer value (2147483647) in seconds

Default value

3600

Syntax

Integer

Example

nsslapd-timelimit: 3600

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 5, 2006

Name | Description | Attributes | See Also

nsslapd-versionstring(5dsconf)

Name | Description | Attributes | See Also

Name

nsslapd-versionstring – version string

Description

Specifies the server version number.

Entry DN

cn=config

Valid range

Any valid server version number.

Default value

Not applicable

Syntax

DirectoryString

Example

nsslapd-versionstring: Directory/11.1.1.3.0

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised June 2010

Name | Description | Attributes | See Also

nsSSL2(5dsconf)

Name | Description | Attributes | See Also

Name

nsSSL2 – SSL v2 support

Description

Supports SSL version 2.

Entry DN

cn=encryption,cn=config

Valid Range

on | off

Default Value

off

Syntax

DirectoryString

Example

nsSSL2: on

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 5, 2006

Name | Description | Attributes | See Also

nsSSL3(5dsconf)

Name | Description | Attributes | See Also

Name

nsSSL3 – SSL v3 support

Description

Supports SSL version 3.

Entry DN

cn=encryption,cn=config

Valid Range

on | off

Default Value

off

Syntax

DirectoryString

Example

nsSSL3: on

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 5, 2006

Name | Description | Attributes | See Also

nsSSL3ciphers(5dsconf)

Name | Description | Attributes | See Also

Name

nsSSL3ciphers – SSL encryption ciphers

Description

This multivalued attribute specifies the set of encryption ciphers Directory Server uses during SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

Entry DN

cn=encryption,cn=config

Valid Range

Ciphers shown as supportedSSLCiphers on the root DSE, or all

Default Value

all

Syntax

DirectoryString

Use the + symbol to enable or - symbol to disable ciphers, followed by the cipher identifier. Blank spaces are not allowed in the list of ciphers.

To enable all ciphers, except rsa_null_md5 which must be specifically called, you can specify all.

Example

nsSSL3ciphers: +RSA_NULL_MD5,+RC4_56_SHA,-RC4_56_SHA

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 10, 2006

Name | Description | Attributes | See Also

nsSSLClientAuth(5dsconf)

Name | Description | Attributes | See Also

Name

nsSSLClientAuth – use SSL client authentication

Description

In an SSL connection, this attribute specifies whether a client certificate is allowed, required, or should not be sent, off, to the SSL server.

Entry DN

cn=encryption,cn=config

Valid Range

off | allowed | required

Default Value

allowed

Syntax

DirectoryString

Example

nsSSLClientAuth: allowed

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 5, 2006

Name | Description | Attributes | See Also

nsSSLServerAuth(5dsconf)

Name | Description | Attributes | See Also

Name

nsSSLServerAuth – use SSL server authentication

Description

Specifies the action that the SSL client should take on the server certificate sent by the SSL server in an SSL connection.

Entry DN

cn=encryption,cn=config

Valid Range

cert

Verify whether the server certificate is from a trusted certificate authority.

cncheck

Verify whether the server certificate is from a trusted certificate authority and verify the DN contained in the server certificate, to avoid man-in-the middle attacks on the server.

weak

Make no attempt to verify whether the server certificate is from a trusted certificate authority.

Default Value

cert

Syntax

DirectoryString

Example

nsSSLServerAuth: cert

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 5, 2006

Name | Description | Attributes | See Also

nsSSLSessionTimeout(5dsconf)

Name | Description | Attributes | See Also

Name

nsSSLSessionTimeout – SSL session time out

Description

Specifies the lifetime duration of an SSL session for both SSLv2 and SSLv3. The minimum timeout value is 5 seconds and if you enter a value below this, it is automatically replaced by 5 seconds. Values outside the valid ranges are replaced by the default value of 100 seconds for SSLv2.

Entry DN

cn=encryption,cn=config

Valid Range

(SSLv2) 5 seconds to 100 seconds

(SSLv3) 5 seconds to 24 hours

Default Value

0, which translates to 100 seconds if you are running SSLv2 and 24 hours if you are running SSLv3

Syntax

Integer

Example

nsSSLSessionTimeout: 5

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 5, 2006

Name | Description | Attributes | See Also

nsState(5dsconf)

Name | Description | Examples | Attributes | See Also

Name

nsState – Clock state for replication, unique ID generation

Description

PROPERTY	VALUE
Entry DN	cn=replica,cn=suffix name,cn=mapping tree,cn=config cn=uniqueid generator,cn=config
Valid Range	N/A
Default Value	N/A
Syntax	Binary

This attribute is part of replica configuration for nsDS5Replica entries.

This attribute is reserved for internal use for handling clock skew and detecting backward clock errors. Do not edit the value of this attribute.

Examples

nsState:: AAEAAAAAAAAAAAAAQ4rs0AAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAA==

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

replication(5dsconf)

ODSEE 11.1.1.3.0  Last Revised March 1, 2010

Name | Description | Examples | Attributes | See Also

nsSystemIndex(5dsconf)

Name | Description | Attributes | See Also

Name

nsSystemIndex – identify index as system index

Description

This mandatory attribute specifies whether the index is a system index, that is, an index that is vital for Directory Server operations. If this attribute has a value of true, it is system essential. System indexes must not be removed as this seriously disrupts server functionality.

Entry DN

cn=default indexes,cn=config,cn=ldbm database, cn=plugins,cn=config

Valid Range

true | false

Default Value

Depends on the index

Syntax

DirectoryString

Example

nssystemindex: true

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 6, 2006

Name | Description | Attributes | See Also

nsTransmittedControls(5dsconf)

Name | Description | Attributes | See Also

Name

nsTransmittedControls – chained LDAP controls

Description

This attribute, which can be both a global, and thus dynamic, configuration, or a cn=chained suffix instance,cn=chaining database, cn=plugins,cn=config instance configuration attribute, allows you to alter the controls that the chained suffix forwards. The following controls are forwarded by default.

• Managed DSA, object identifier: 2.16.840.1.113730.3.4.2.

• Virtual list view (VLV), object identifier: 2.16.840.1.113730.3.4.9

• Server side sorting, object identifier: 1.2.840.113556.1.4.473

Entry DN

cn=config,cn=chaining database,cn=plugins,cn=config

Valid Range

Any valid OID or the above listed controls forwarded by the chained suffix.

Default Value

None

Syntax

Integer

Example

nsTransmittedControls: 1.2.840.113556.1.4.473

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 6, 2006

Name | Description | Attributes | See Also

op-type(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

repl-priority, attr, base-dn, bind-dn, op-type – DS prioritized replication configuration (RPR) properties

Description

Prioritized replication lets you force a Directory Server supplier to assign higher priority to certain updates replicated on a Directory Server consumer. You prioritize replication operations by creating replication priority rules.

PROPERTY: attr

Syntax	ATTR_NAME
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the attribute type to which the replication priority rule applies.

PROPERTY: base-dn

Syntax	DN
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the DN under which the replication priority rule applies. For example, if you set base-dn:ou=administrators,dc=example,dc=com, then changes to uid=myAdmin,ou=administrators,dc=example,dc=com might be replicated with high priority, but changes to uid=bjensen,ou=people,dc=example,dc=com would not.

PROPERTY: bind-dn

Syntax	DN
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a bind DN for an account whose updates might be replicated with high priority.

PROPERTY: op-type

Syntax	add | mod | del
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a type of operation for which updates might be replicated with high priority.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M)

ODSEE 11.1.1.3.0  Last Revised June 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

parent-suffix-dn(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

suffix, db-name, entry-cache-count, entry-cache-size, entry-count, index-filter-analyzer-enabled, index-filter-analyzer-max-entries, parent-suffix-dn, referral-mode, repl-accept-client-update-enabled, repl-cl-max-age, repl-cl-max-entry-count, repl-id, repl-manager-bind-dn, repl-purge-delay, repl-rewrite-referrals-enabled, repl-role, require-index-enabled – DS suffix configuration (SUF) properties

Description

Each Directory Server suffix you create is configured according to the suffix properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: db-name

Syntax	STRING
Default Value	suffixName
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the suffix that is used to process requests involving the database.

PROPERTY: db-path

Syntax	PATH
Default Value	server-instance-dir/db/suffix-dir
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the absolute path to the suffix database.

PROPERTY: entry-cache-count

Syntax	INTEGER | unlimited
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of entries allowed in the entry cache of the suffix.

PROPERTY: entry-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum amount of memory Directory Server requests for the entry cache of the suffix.

PROPERTY: entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the number of entries stored in the suffix.

PROPERTY: index-filter-analyzer-enabled

Syntax	off and on
Default Value	off
Is readable	Yes
Is modifiable	No
Is multi-valued	No
Restart needed	No

This property specifies whether the index filter analyzer is running.

PROPERTY: index-filter-analyzer-max-entries

Syntax	Integer
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No
Restart needed	No

This property specifies the maximum number of entries that the index filter analyzer may contain.

PROPERTY: parent-suffix-dn

Syntax	DN | undefined
Default Value	DN of the parent entry
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the DN of the parent entry for the suffix. The value of this property must logically be a parent of the suffix.

For instance, if you have a suffix with DN dc=com and a suffix dc=example,dc=com, you can set dc=com as the parent-suffix-dn of dc=example,dc=com, and subtree searches with based DN dc=com then also travers dc=example,dc=com.

PROPERTY: referral-mode

Syntax	disabled | enabled | only-on-write
Default Value	disabled
Is readable	Yes
Is modifiable	Yes, if the suffix is not replicated
Is multi-valued	No

This property specifies how referrals are used when a client makes a request involving the suffix.

disabled

Handle requests locally; do not return referral URLs.

enabled

Return referral URLs to client requests.

only-on-write

Return referral URLs to client requests only for write operations.

PROPERTY: repl-accept-client-update-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the replicated suffix accepts write operations from client applications, or instead returns referral URLs.

PROPERTY: repl-cl-max-age

Syntax	DURATION | undefined
Default Value	7d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age for a record in the replication changelog. Older records are purged.

PROPERTY: repl-cl-max-entry-count

Syntax	INTEGER
Default Value	0 (meaning undefined)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the replication changelog. When the limit is exceeded, older records are purged.

PROPERTY: repl-id

Syntax	INTEGER
Default Value	None
Is readable	Yes
Is modifiable	Yes, using the subcommands to manage replication
Is multi-valued	No

This property specifies the replica identification number, 1-65534 for a supplier, 65535 for a consumer or a hub. Once set, this property cannot be modified.

PROPERTY: repl-manager-bind-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the bind DNs of users allowed to bind to perform replication operations on the suffix.

PROPERTY: repl-purge-delay

Syntax	DURATION | never
Default Value	7d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of tombstone entries used by replication. Tombstone entries are entries marked for deletion that have not yet been removed, and also replication state information associated with the entries. When setting this attribute, ensure that the purge delay is longer than the longest replication cycle in your replication policy to avoid incurring conflict resolution problems and divergence between replicas.

PROPERTY: repl-rewrite-referrals-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referrals you set can be automatically overwritten by the server to reference replicas.

PROPERTY: repl-role

Syntax	not-replicated | master | hub | consumer
Default Value	not-replicated
Is readable	Yes
Is modifiable	Yes, using the subcommands to manage replication
Is multi-valued	No

This property specifies the role played by the suffix in a replicated topology.

not-replicated

The suffix is not part of a replicated toplogy.

master

This suffix is a supplier of replication updates in a replicated topology. It can accept both read and write operations.

hub

This suffix is a supplier of replication updates in a replicated topology. It can accept read operations and replication updates.

consumer

This suffix is a dedicated consumer of replication updates in a replicated topology. It can accept read operations and replication updates, but not writes from clients.

To promote a replica, use the dsconf promote-repl command. To demote a replica, use the dsconf demote-repl command.

PROPERTY: require-index-enabled

Syntax	on|off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether unindexed searches are allowed. When on, unindexed searches return LDAP_UNWILLING_TO_PERFORM.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), enabled(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

path(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

log, buffering-enabled, level, max-age, max-disk-space-size, max-file-count, max-size, min-free-disk-space-size, path, perm, rotation-interval, rotation-min-file-size, rotation-time, verbose-enabled – DS logging configuration (LOG) properties

Description

Directory Server writes to three main types of log files you can configure, the INSTANCE_PATH/logs/access, INSTANCE_PATH/logs/audit, and INSTANCE_PATH/logs/errors logs, where INSTANCE_PATH is the full path where the server instance is located, such as /local/dsInst.

When you specify one of these properties with dsconf get-log-prop or dsconf set-log-prop, you must specify which type of log configuration, access, audit, or error, you want to examine. For example, to see whether audit logging is enabled for a server instance:

$ dsconf get-log-prop audit enabled enabled : off $

PROPERTY: buffering-enabled

Syntax	on | off
Default Value	on for access, not applicable to audit and errors logs
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property indicates whether Directory Server writes access log entries directly to disk, or use a buffer, by default.

PROPERTY: enabled

Syntax	on | off
Default Value	on for access, off for audit, on for errors
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property indicates whether the specified log type is enabled.

PROPERTY: level

Syntax	See the description that follows.
Default Value	default
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property defines which kinds of messages get logged. This property is applicable only to access and errors logs.

access log levels

The following settings are supported:

acc-internal

Log access information for internal operations.

default

Log client access to entries.

acc-default_plus_referrals

As default, but also log access to referrals.

acc-timing

Use precise timing for microsecond resolution of elapsed times.

errors log levels

The following settings are supported:

default

Log startup, shutdown, errors, and warnings.

err-function-calls

Log when server enters or exits a function.

err-search-args

Log search arguments.

err-connection

Connection management.

err-packets

Log packets sent and received.

err-search-filter

Log search filter information.

err-config-file

Log information for changes to the configuration file dse.ldif.

err-acl

Log access control processing information.

err-ldbm

Log information from the ldbm database plugin.

err-entry-parsing

Log LDIF parsing errors.

err-housekeeping

Log event queue information.

err-replication

Log information about replication operations.

err-entry-cache

Log entry cache information.

err-plugins

Log information from server plug-ins.

err-dsml

Log information from DSML front end.

err-dsml-advanced

Debugging information for DSML.

PROPERTY: max-age

Syntax	DURATION | unlimited
Default Value	1M (one month)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the age beyond which the specified type of log file is deleted.

PROPERTY: max-disk-space-size

Syntax	MEMORY_SIZE | unlimited
Default Value	500M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the maximum disk space the specified type of log is allowed to consume. When the limit is reached, the server deletes the oldest log file to reclaim disk space.

PROPERTY: max-file-count

Syntax	Integer
Default Value	10 for access, 2 for errors, 1 for audit
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the maximum number of log files, including rotated logs, of the specified type that the server allows to be created in the log file directory. When the limit is reached, the server deletes the oldest log file to reclaim disk space.

When you set this property to 1, the specified log is not rotated.

PROPERTY: max-size

Syntax	MEMORY_SIZE | unlimited
Default Value	100M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the maximum file size for the specified log. When the limit is reached, the server rotates the log file, unless max-file-count is set to 1.

PROPERTY: min-free-disk-space-size

Syntax	MEMORY_SIZE
Default Value	5M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the minimum free space allowed on the disk where the specified log is stored. When the limit is reached, the server deletes the oldest log files until enough space is available.

PROPERTY: path

Syntax	PATH
Default Value	INSTANCE_PATH/logs/access, INSTANCE_PATH/logs/audit, INSTANCE_PATH/logs/errors
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the full path to the specified log file type.

PROPERTY: perm

Syntax	OCTAL_MODE
Default Value	600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the read, write, and execute permissions on the specified log file.

PROPERTY: rotation-interval

Syntax	DURATION | unlimited
Default Value	1d (one day) for access, 1w (one week) for audit and errors
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the duration between rotations of the specified log file.

PROPERTY: rotation-min-file-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the minimum size the specified log file must have before the server rotates it.

PROPERTY: rotation-time

Syntax	TIME | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the time of day when the server rotates the specified log file.

PROPERTY: verbose-enabled

Syntax	on|off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether extra informational messages are written to the errors log.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), enabled(5dsconf)

ODSEE 11.1.1.3.0  Last Revised April 12, 2007

Name | Description | SYNTAX VALUES | Attributes | See Also

perm(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

log, buffering-enabled, level, max-age, max-disk-space-size, max-file-count, max-size, min-free-disk-space-size, path, perm, rotation-interval, rotation-min-file-size, rotation-time, verbose-enabled – DS logging configuration (LOG) properties

Description

Directory Server writes to three main types of log files you can configure, the INSTANCE_PATH/logs/access, INSTANCE_PATH/logs/audit, and INSTANCE_PATH/logs/errors logs, where INSTANCE_PATH is the full path where the server instance is located, such as /local/dsInst.

When you specify one of these properties with dsconf get-log-prop or dsconf set-log-prop, you must specify which type of log configuration, access, audit, or error, you want to examine. For example, to see whether audit logging is enabled for a server instance:

$ dsconf get-log-prop audit enabled enabled : off $

PROPERTY: buffering-enabled

Syntax	on | off
Default Value	on for access, not applicable to audit and errors logs
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property indicates whether Directory Server writes access log entries directly to disk, or use a buffer, by default.

PROPERTY: enabled

Syntax	on | off
Default Value	on for access, off for audit, on for errors
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property indicates whether the specified log type is enabled.

PROPERTY: level

Syntax	See the description that follows.
Default Value	default
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property defines which kinds of messages get logged. This property is applicable only to access and errors logs.

access log levels

The following settings are supported:

acc-internal

Log access information for internal operations.

default

Log client access to entries.

acc-default_plus_referrals

As default, but also log access to referrals.

acc-timing

Use precise timing for microsecond resolution of elapsed times.

errors log levels

The following settings are supported:

default

Log startup, shutdown, errors, and warnings.

err-function-calls

Log when server enters or exits a function.

err-search-args

Log search arguments.

err-connection

Connection management.

err-packets

Log packets sent and received.

err-search-filter

Log search filter information.

err-config-file

Log information for changes to the configuration file dse.ldif.

err-acl

Log access control processing information.

err-ldbm

Log information from the ldbm database plugin.

err-entry-parsing

Log LDIF parsing errors.

err-housekeeping

Log event queue information.

err-replication

Log information about replication operations.

err-entry-cache

Log entry cache information.

err-plugins

Log information from server plug-ins.

err-dsml

Log information from DSML front end.

err-dsml-advanced

Debugging information for DSML.

PROPERTY: max-age

Syntax	DURATION | unlimited
Default Value	1M (one month)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the age beyond which the specified type of log file is deleted.

PROPERTY: max-disk-space-size

Syntax	MEMORY_SIZE | unlimited
Default Value	500M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the maximum disk space the specified type of log is allowed to consume. When the limit is reached, the server deletes the oldest log file to reclaim disk space.

PROPERTY: max-file-count

Syntax	Integer
Default Value	10 for access, 2 for errors, 1 for audit
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the maximum number of log files, including rotated logs, of the specified type that the server allows to be created in the log file directory. When the limit is reached, the server deletes the oldest log file to reclaim disk space.

When you set this property to 1, the specified log is not rotated.

PROPERTY: max-size

Syntax	MEMORY_SIZE | unlimited
Default Value	100M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the maximum file size for the specified log. When the limit is reached, the server rotates the log file, unless max-file-count is set to 1.

PROPERTY: min-free-disk-space-size

Syntax	MEMORY_SIZE
Default Value	5M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the minimum free space allowed on the disk where the specified log is stored. When the limit is reached, the server deletes the oldest log files until enough space is available.

PROPERTY: path

Syntax	PATH
Default Value	INSTANCE_PATH/logs/access, INSTANCE_PATH/logs/audit, INSTANCE_PATH/logs/errors
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the full path to the specified log file type.

PROPERTY: perm

Syntax	OCTAL_MODE
Default Value	600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the read, write, and execute permissions on the specified log file.

PROPERTY: rotation-interval

Syntax	DURATION | unlimited
Default Value	1d (one day) for access, 1w (one week) for audit and errors
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the duration between rotations of the specified log file.

PROPERTY: rotation-min-file-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the minimum size the specified log file must have before the server rotates it.

PROPERTY: rotation-time

Syntax	TIME | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the time of day when the server rotates the specified log file.

PROPERTY: verbose-enabled

Syntax	on|off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether extra informational messages are written to the errors log.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), enabled(5dsconf)

ODSEE 11.1.1.3.0  Last Revised April 12, 2007

Name | Description | SYNTAX VALUES | Attributes | See Also

plugin(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

plugin, argument, depends-on-named, depends-on-type, feature, init-func, lib-path, type, vendor, version – DS plug-in configuration (PLG) properties

Description

Directory Server implements some key functionality as plug-ins. Plug-ins take the form of libraries loaded when the server starts, and called at different points in the processing of client application requests. When you create custom plug-ins, you must configure the server to load and use them, then restart Directory Server to load the newly configured plug-ins.

PROPERTY: argument

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies arguments passed to the plug-in when it is loaded by Directory Server. Arguments are passed in the order you specify them. Updating the list of arguments replaces all the existing arguments previously specified when the plug-in is loaded again.

PROPERTY: depends-on-named

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies names of plug-ins that must be available and loaded before Directory Server loads the current plug-in.

PROPERTY: depends-on-type

Syntax	STRING (See the description that follows.)
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies types of plug-ins that must be available and loaded before Directory Server loads the current plug-in. The value must be the value of a plug-in type property.

PROPERTY: feature

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the plug-in identifier from the Slapi_PluginDesc structure.

PROPERTY: init-func

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of function called by Directory Server to initialize the plug-in.

PROPERTY: lib-path

Syntax	PATH
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the absolute file system path to the library containing plug-in.

PROPERTY: type

Syntax	STRING (See the description that follows.)
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the plug-in type. The following plug-in types are supported.

ldbmentryfetchstore

Entry store and fetch plug-in

extendedop

Extended operation plug-in

passwordcheck

Password check plug-in

postoperation

Post-operation plug-in

preoperation

Pre-operation plug-in

internalpostoperation

Internal post-operation plug-in

internalpreoperation

Internal pre-operation plug-in

matchingrule

Matching rule plug-in for extensible match search filters

object

Generic plug-in type, sometimes used to register other plug-ins

passwordcheck

Strong password check plug-in

pwdstoragescheme

Password storage scheme plug-in

PROPERTY: vendor

Syntax	STRING
Default Value	Vendor name in plug-in configuration
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the plug-in vendor from the Slapi_PluginDesc structure.

PROPERTY: version

Syntax	STRING
Default Value	Version string in plug-in configuration
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the plug-in version from the Slapi_PluginDesc structure.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Stable

See Also

dsconf(1M), desc(5dsconf), enabled(5dsconf)

ODSEE 11.1.1.3.0  Last Revised June 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

polling-thread-count(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

pres-enabled(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

index, all-ids-threshold-eq, all-ids-threshold-pres, all-ids-threshold-sub, approx-enabled, eq-enabled, matching-rule, pres-enabled, sub-enabled, system – DS attribute indexing (IDX) properties

Description

Directory Server can index attributes, making them faster to search. The dsconf command helps you configure five of the six supported index types:

1. Equality indexes to determine expediently whether an attribute value is equal to a specified value

2. Presence indexes to determine whether a specified attribute has any values

3. Substring indexes to determine whether a specified attribute has values containing a specified string, also used to compare regular expressions to attribute values

4. Approximate indexes, based on metaphone approximation and useful for English language strings only, to determine whether a specified attribute has any values that sound like the specified string

5. International indexes, also called matching rule indexes, to expedite sorting and searching in accordance with the language rules of a particular locale

The dsconf command does not help you configure virtual list view, also known as browsing, indexes.

The dsconf command does help you assign all IDs threshold values to indexes. As the number of entries and attribute values grows in a directory, the number of attribute values to index also grows, as does therefore the size of the indexes. In some deployments a server can end up maintaining index lists so large that the cost of rebuilding an index when attributes are modified or added outweighs the benefit the index provides for searches. All IDs thresholds limit the growth of large indexes by definining the maximum number of entry identifiers Directory Server maintains in an index list. You can define all IDs thresholds for individual indexes and for some types of indexes.

Some indexes are maintained by the server for its own use. These are called system indexes. In general, do not modify or remove systems indexes; such modifications could have severe repercussions on performance.

See Directory Server Indexing in Oracle Fusion Middleware Reference for Oracle Directory Server Enterprise Edition for further details about indexing.

PROPERTY: all-ids-threshold

Syntax	INTEGER | inherited
Default Value	inherited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the maximum number of entry IDs the server maintains in an index list for the specified attribute type. By default its value is inherited from the all-ids-threshold setting for the suffix, whose default value in turn is inherited from the all-ids-threshold setting for the server, which by default is 4000. In addition to inheritance of default settings, this property handles settings as follows:

inherited

The threshold is inherited from the more global setting.

<2000

The threshold value is rounded up to 2000.

>2000

The setting is used as a guaranteed minimum threshold. Because of internal mechanisms, the real value can be slightly more than the specified value.

After you modify this property, reindex the attribute for which you changed the threshold. For example:

$ dsconf set-index-prop dc=example,dc=com uid all-ids-threshold:5000 $ dsconf reindex -t uid dc=example,dc=com ## example: Indexing attribute: uid ## example: Finished indexing. Task completed (slapd exit code: 0). $

PROPERTY: all-ids-threshold-eq

Syntax	INTEGER | inherited
Default Value	inherited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the all IDs threshold for equality indexes of the specified attribute. By default its value is inherited from the all-ids-threshold setting for the attribute type. See all-ids-threshold(5dsconf) for more information.

PROPERTY: all-ids-threshold-pres

Syntax	INTEGER | inherited
Default Value	inherited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the all IDs threshold for presence indexes of the specified attribute. By default its value is inherited from the all-ids-threshold setting for the attribute type. See all-ids-threshold(5dsconf) for more information.

PROPERTY: all-ids-threshold-sub

Syntax	INTEGER | inherited
Default Value	inherited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the all IDs threshold for substring indexes of the specified attribute. By default its value is inherited from the all-ids-threshold setting for the attribute type. See all-ids-threshold(5dsconf) for more information.

PROPERTY: approx-enabled

Syntax	on|off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether approximate indexes are maintained for the specified attribute type. You cannot set an all IDs threshold value for approximate indexes.

PROPERTY: desc

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

Use this optional property to provide a short description of the index configuration.

PROPERTY: eq-enabled

Syntax	on|off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether equality indexes are maintained for the specified attribute type.

PROPERTY: matching-rule

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the matching rule indexes maintained for the specified attribute type.

Values for this property must be valid collation order object identifiers (OIDs). See Directory Server Internationalized Directory in Directory Server Enterprise Edition Reference for the OIDs corresponding to supported locales.

PROPERTY: pres-enabled

Syntax	on|off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether presence indexes are maintained for the specified attribute type.

PROPERTY: sub-enabled

Syntax	on|off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether substring indexes are maintained for the specified attribute type.

PROPERTY: system

Syntax	true|false
Default Value	false
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property identifies whether the specified index is a system index, and therefore should be left alone.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), desc(5dsconf)

ODSEE 11.1.1.3.0  Last Revised June 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

pwd-accept-hashed-pwd-enabled(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

pwd-check-enabled(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

pwd-compat-mode(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

pwd-expire-no-warning-enabled(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

pwd-expire-warning-delay(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

pwd-failure-count-interval(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

pwd-grace-login-limit(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

pwd-keep-last-auth-time-enabled(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

pwd-lockout-duration(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

pwd-lockout-enabled(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

pwd-lockout-repl-priority-enabled(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

pwd-max-age(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

pwd-max-failure-count(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

pwd-max-history-count(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

pwd-min-age(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

pwd-min-length(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

pwd-mod-gen-length(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

pwd-must-change-enabled(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

pwd-root-dn-bypass-enabled(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

pwd-safe-modify-enabled(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

pwd-storage-scheme(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

pwd-strong-check-dictionary-path(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

pwd-strong-check-enabled(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

pwd-strong-check-require-charset(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

pwd-supported-storage-scheme(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

pwd-user-change-enabled(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

read-write-mode(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

referral-mode(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

suffix, db-name, entry-cache-count, entry-cache-size, entry-count, index-filter-analyzer-enabled, index-filter-analyzer-max-entries, parent-suffix-dn, referral-mode, repl-accept-client-update-enabled, repl-cl-max-age, repl-cl-max-entry-count, repl-id, repl-manager-bind-dn, repl-purge-delay, repl-rewrite-referrals-enabled, repl-role, require-index-enabled – DS suffix configuration (SUF) properties

Description

Each Directory Server suffix you create is configured according to the suffix properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: db-name

Syntax	STRING
Default Value	suffixName
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the suffix that is used to process requests involving the database.

PROPERTY: db-path

Syntax	PATH
Default Value	server-instance-dir/db/suffix-dir
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the absolute path to the suffix database.

PROPERTY: entry-cache-count

Syntax	INTEGER | unlimited
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of entries allowed in the entry cache of the suffix.

PROPERTY: entry-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum amount of memory Directory Server requests for the entry cache of the suffix.

PROPERTY: entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the number of entries stored in the suffix.

PROPERTY: index-filter-analyzer-enabled

Syntax	off and on
Default Value	off
Is readable	Yes
Is modifiable	No
Is multi-valued	No
Restart needed	No

This property specifies whether the index filter analyzer is running.

PROPERTY: index-filter-analyzer-max-entries

Syntax	Integer
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No
Restart needed	No

This property specifies the maximum number of entries that the index filter analyzer may contain.

PROPERTY: parent-suffix-dn

Syntax	DN | undefined
Default Value	DN of the parent entry
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the DN of the parent entry for the suffix. The value of this property must logically be a parent of the suffix.

For instance, if you have a suffix with DN dc=com and a suffix dc=example,dc=com, you can set dc=com as the parent-suffix-dn of dc=example,dc=com, and subtree searches with based DN dc=com then also travers dc=example,dc=com.

PROPERTY: referral-mode

Syntax	disabled | enabled | only-on-write
Default Value	disabled
Is readable	Yes
Is modifiable	Yes, if the suffix is not replicated
Is multi-valued	No

This property specifies how referrals are used when a client makes a request involving the suffix.

disabled

Handle requests locally; do not return referral URLs.

enabled

Return referral URLs to client requests.

only-on-write

Return referral URLs to client requests only for write operations.

PROPERTY: repl-accept-client-update-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the replicated suffix accepts write operations from client applications, or instead returns referral URLs.

PROPERTY: repl-cl-max-age

Syntax	DURATION | undefined
Default Value	7d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age for a record in the replication changelog. Older records are purged.

PROPERTY: repl-cl-max-entry-count

Syntax	INTEGER
Default Value	0 (meaning undefined)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the replication changelog. When the limit is exceeded, older records are purged.

PROPERTY: repl-id

Syntax	INTEGER
Default Value	None
Is readable	Yes
Is modifiable	Yes, using the subcommands to manage replication
Is multi-valued	No

This property specifies the replica identification number, 1-65534 for a supplier, 65535 for a consumer or a hub. Once set, this property cannot be modified.

PROPERTY: repl-manager-bind-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the bind DNs of users allowed to bind to perform replication operations on the suffix.

PROPERTY: repl-purge-delay

Syntax	DURATION | never
Default Value	7d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of tombstone entries used by replication. Tombstone entries are entries marked for deletion that have not yet been removed, and also replication state information associated with the entries. When setting this attribute, ensure that the purge delay is longer than the longest replication cycle in your replication policy to avoid incurring conflict resolution problems and divergence between replicas.

PROPERTY: repl-rewrite-referrals-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referrals you set can be automatically overwritten by the server to reference replicas.

PROPERTY: repl-role

Syntax	not-replicated | master | hub | consumer
Default Value	not-replicated
Is readable	Yes
Is modifiable	Yes, using the subcommands to manage replication
Is multi-valued	No

This property specifies the role played by the suffix in a replicated topology.

not-replicated

The suffix is not part of a replicated toplogy.

master

This suffix is a supplier of replication updates in a replicated topology. It can accept both read and write operations.

hub

This suffix is a supplier of replication updates in a replicated topology. It can accept read operations and replication updates.

consumer

This suffix is a dedicated consumer of replication updates in a replicated topology. It can accept read operations and replication updates, but not writes from clients.

To promote a replica, use the dsconf promote-repl command. To demote a replica, use the dsconf demote-repl command.

PROPERTY: require-index-enabled

Syntax	on|off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether unindexed searches are allowed. When on, unindexed searches return LDAP_UNWILLING_TO_PERFORM.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), enabled(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

referral-url(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

referral-url – Whether the server accepts mod DN operations

Description

Syntax	LDAP_URL | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the URLs returned as referrals when clients request an operation not supported by the server instance or suffix for the target entry.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), server(5dsconf), suffix(5dsconf)

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | SYNTAX VALUES | Attributes | See Also

ref-integrity-attr(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

ref-integrity-check-delay(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

ref-integrity-enabled(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

repl-accept-client-update-enabled(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

suffix, db-name, entry-cache-count, entry-cache-size, entry-count, index-filter-analyzer-enabled, index-filter-analyzer-max-entries, parent-suffix-dn, referral-mode, repl-accept-client-update-enabled, repl-cl-max-age, repl-cl-max-entry-count, repl-id, repl-manager-bind-dn, repl-purge-delay, repl-rewrite-referrals-enabled, repl-role, require-index-enabled – DS suffix configuration (SUF) properties

Description

Each Directory Server suffix you create is configured according to the suffix properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: db-name

Syntax	STRING
Default Value	suffixName
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the suffix that is used to process requests involving the database.

PROPERTY: db-path

Syntax	PATH
Default Value	server-instance-dir/db/suffix-dir
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the absolute path to the suffix database.

PROPERTY: entry-cache-count

Syntax	INTEGER | unlimited
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of entries allowed in the entry cache of the suffix.

PROPERTY: entry-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum amount of memory Directory Server requests for the entry cache of the suffix.

PROPERTY: entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the number of entries stored in the suffix.

PROPERTY: index-filter-analyzer-enabled

Syntax	off and on
Default Value	off
Is readable	Yes
Is modifiable	No
Is multi-valued	No
Restart needed	No

This property specifies whether the index filter analyzer is running.

PROPERTY: index-filter-analyzer-max-entries

Syntax	Integer
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No
Restart needed	No

This property specifies the maximum number of entries that the index filter analyzer may contain.

PROPERTY: parent-suffix-dn

Syntax	DN | undefined
Default Value	DN of the parent entry
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the DN of the parent entry for the suffix. The value of this property must logically be a parent of the suffix.

For instance, if you have a suffix with DN dc=com and a suffix dc=example,dc=com, you can set dc=com as the parent-suffix-dn of dc=example,dc=com, and subtree searches with based DN dc=com then also travers dc=example,dc=com.

PROPERTY: referral-mode

Syntax	disabled | enabled | only-on-write
Default Value	disabled
Is readable	Yes
Is modifiable	Yes, if the suffix is not replicated
Is multi-valued	No

This property specifies how referrals are used when a client makes a request involving the suffix.

disabled

Handle requests locally; do not return referral URLs.

enabled

Return referral URLs to client requests.

only-on-write

Return referral URLs to client requests only for write operations.

PROPERTY: repl-accept-client-update-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the replicated suffix accepts write operations from client applications, or instead returns referral URLs.

PROPERTY: repl-cl-max-age

Syntax	DURATION | undefined
Default Value	7d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age for a record in the replication changelog. Older records are purged.

PROPERTY: repl-cl-max-entry-count

Syntax	INTEGER
Default Value	0 (meaning undefined)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the replication changelog. When the limit is exceeded, older records are purged.

PROPERTY: repl-id

Syntax	INTEGER
Default Value	None
Is readable	Yes
Is modifiable	Yes, using the subcommands to manage replication
Is multi-valued	No

This property specifies the replica identification number, 1-65534 for a supplier, 65535 for a consumer or a hub. Once set, this property cannot be modified.

PROPERTY: repl-manager-bind-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the bind DNs of users allowed to bind to perform replication operations on the suffix.

PROPERTY: repl-purge-delay

Syntax	DURATION | never
Default Value	7d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of tombstone entries used by replication. Tombstone entries are entries marked for deletion that have not yet been removed, and also replication state information associated with the entries. When setting this attribute, ensure that the purge delay is longer than the longest replication cycle in your replication policy to avoid incurring conflict resolution problems and divergence between replicas.

PROPERTY: repl-rewrite-referrals-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referrals you set can be automatically overwritten by the server to reference replicas.

PROPERTY: repl-role

Syntax	not-replicated | master | hub | consumer
Default Value	not-replicated
Is readable	Yes
Is modifiable	Yes, using the subcommands to manage replication
Is multi-valued	No

This property specifies the role played by the suffix in a replicated topology.

not-replicated

The suffix is not part of a replicated toplogy.

master

This suffix is a supplier of replication updates in a replicated topology. It can accept both read and write operations.

hub

This suffix is a supplier of replication updates in a replicated topology. It can accept read operations and replication updates.

consumer

This suffix is a dedicated consumer of replication updates in a replicated topology. It can accept read operations and replication updates, but not writes from clients.

To promote a replica, use the dsconf promote-repl command. To demote a replica, use the dsconf demote-repl command.

PROPERTY: require-index-enabled

Syntax	on|off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether unindexed searches are allowed. When on, unindexed searches return LDAP_UNWILLING_TO_PERFORM.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), enabled(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

repl-agmt(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

repl-agmt, auth-bind-dn, auth-protocol, auth-pwd, repl-fractional-exclude-attr, repl-fractional-include-attr, repl-schedule, transport-compression, transport-group-size, transport-window-size – DS replication agreement configuration (RAG) properties

Description

A replication agreement governs how a Directory Server supplier updates a Directory Server consumer. Although this configuration element is called an agreement, it concerns the configuration only of the supplier.

PROPERTY: auth-bind-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the bind DN used by the supplier to bind to the consumer in order to perform replication-related updates. This bind DN must be present on the consumer.

PROPERTY: auth-protocol

Syntax	clear|ssl-simple|ssl-client
Default Value	clear
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the protocol used by the supplier to bind to the consumer in order to perform replication-related updates. The default is to bind with simple authentication in clear text without securing the connection, as most replications connections are made on an internal network. You may however configure replication to use SSL and simple authentication to protect the connection from malicious snooping, or SSL with client authentication to further protect the connection.

PROPERTY: auth-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password used by the supplier to bind to the consumer. You provide it using auth-pwd-file.

PROPERTY: auth-pwd-file

Syntax	PATH
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the bind password for replication is read to create the replication agreement. The file is read once on replication agreement creation, and the password is stored for future use.

PROPERTY: repl-fractional-exclude-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the list of attributes not to replicate. This property is mutually exclusive with repl-fractional-include-attr.

PROPERTY: repl-fractional-include-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the list of attributes to replicate. This property is mutually exclusive with repl-fractional-exclude-attr.

PROPERTY: repl-schedule

Syntax	INTERVAL | always
Default Value	always
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the times and days when replication can take place.

PROPERTY: transport-compression

Syntax	best-compression | best-speed | default-compression | no-compression
Default Value	no-compression
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the level of libz(3) compression used on replication updates from the supplier to the consumer. Supported settings are as follows.

no-compression

No compression

default-compression

Default zlib compression (zlib numeric value = -1)

best-speed

Fastest zlib compression (zlib numeric value = 1)

best-compression

Strongest zlib compression (zlib numeric value = 9)

If the bottleneck for replication in your environment is network bandwidth, this property can potentially help you tune the replication protocol for better performance.

PROPERTY: transport-group-size

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many replication messages are grouped on the supplier before being sent to the consumer. Valid range is 1 to 255.

If the bottleneck for replication in your environment is network bandwidth, this property can potentially help you tune the replication protocol for better performance.

PROPERTY: transport-window-size

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of replication messages sent from the supplier to the consumer before waiting for a response from the consumer to continue. Valid range is 1 to 65535.

If the bottleneck for replication in your environment is network latency or network bandwidth, this property can potentially help you tune the replication protocol for better performance.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), desc(5dsconf), enabled(5dsconf)

ODSEE 11.1.1.3.0  Last Revised June 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

repl-cl-max-age(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

suffix, db-name, entry-cache-count, entry-cache-size, entry-count, index-filter-analyzer-enabled, index-filter-analyzer-max-entries, parent-suffix-dn, referral-mode, repl-accept-client-update-enabled, repl-cl-max-age, repl-cl-max-entry-count, repl-id, repl-manager-bind-dn, repl-purge-delay, repl-rewrite-referrals-enabled, repl-role, require-index-enabled – DS suffix configuration (SUF) properties

Description

Each Directory Server suffix you create is configured according to the suffix properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: db-name

Syntax	STRING
Default Value	suffixName
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the suffix that is used to process requests involving the database.

PROPERTY: db-path

Syntax	PATH
Default Value	server-instance-dir/db/suffix-dir
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the absolute path to the suffix database.

PROPERTY: entry-cache-count

Syntax	INTEGER | unlimited
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of entries allowed in the entry cache of the suffix.

PROPERTY: entry-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum amount of memory Directory Server requests for the entry cache of the suffix.

PROPERTY: entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the number of entries stored in the suffix.

PROPERTY: index-filter-analyzer-enabled

Syntax	off and on
Default Value	off
Is readable	Yes
Is modifiable	No
Is multi-valued	No
Restart needed	No

This property specifies whether the index filter analyzer is running.

PROPERTY: index-filter-analyzer-max-entries

Syntax	Integer
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No
Restart needed	No

This property specifies the maximum number of entries that the index filter analyzer may contain.

PROPERTY: parent-suffix-dn

Syntax	DN | undefined
Default Value	DN of the parent entry
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the DN of the parent entry for the suffix. The value of this property must logically be a parent of the suffix.

For instance, if you have a suffix with DN dc=com and a suffix dc=example,dc=com, you can set dc=com as the parent-suffix-dn of dc=example,dc=com, and subtree searches with based DN dc=com then also travers dc=example,dc=com.

PROPERTY: referral-mode

Syntax	disabled | enabled | only-on-write
Default Value	disabled
Is readable	Yes
Is modifiable	Yes, if the suffix is not replicated
Is multi-valued	No

This property specifies how referrals are used when a client makes a request involving the suffix.

disabled

Handle requests locally; do not return referral URLs.

enabled

Return referral URLs to client requests.

only-on-write

Return referral URLs to client requests only for write operations.

PROPERTY: repl-accept-client-update-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the replicated suffix accepts write operations from client applications, or instead returns referral URLs.

PROPERTY: repl-cl-max-age

Syntax	DURATION | undefined
Default Value	7d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age for a record in the replication changelog. Older records are purged.

PROPERTY: repl-cl-max-entry-count

Syntax	INTEGER
Default Value	0 (meaning undefined)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the replication changelog. When the limit is exceeded, older records are purged.

PROPERTY: repl-id

Syntax	INTEGER
Default Value	None
Is readable	Yes
Is modifiable	Yes, using the subcommands to manage replication
Is multi-valued	No

This property specifies the replica identification number, 1-65534 for a supplier, 65535 for a consumer or a hub. Once set, this property cannot be modified.

PROPERTY: repl-manager-bind-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the bind DNs of users allowed to bind to perform replication operations on the suffix.

PROPERTY: repl-purge-delay

Syntax	DURATION | never
Default Value	7d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of tombstone entries used by replication. Tombstone entries are entries marked for deletion that have not yet been removed, and also replication state information associated with the entries. When setting this attribute, ensure that the purge delay is longer than the longest replication cycle in your replication policy to avoid incurring conflict resolution problems and divergence between replicas.

PROPERTY: repl-rewrite-referrals-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referrals you set can be automatically overwritten by the server to reference replicas.

PROPERTY: repl-role

Syntax	not-replicated | master | hub | consumer
Default Value	not-replicated
Is readable	Yes
Is modifiable	Yes, using the subcommands to manage replication
Is multi-valued	No

This property specifies the role played by the suffix in a replicated topology.

not-replicated

The suffix is not part of a replicated toplogy.

master

This suffix is a supplier of replication updates in a replicated topology. It can accept both read and write operations.

hub

This suffix is a supplier of replication updates in a replicated topology. It can accept read operations and replication updates.

consumer

This suffix is a dedicated consumer of replication updates in a replicated topology. It can accept read operations and replication updates, but not writes from clients.

To promote a replica, use the dsconf promote-repl command. To demote a replica, use the dsconf demote-repl command.

PROPERTY: require-index-enabled

Syntax	on|off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether unindexed searches are allowed. When on, unindexed searches return LDAP_UNWILLING_TO_PERFORM.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), enabled(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

repl-cl-max-entry-count(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

suffix, db-name, entry-cache-count, entry-cache-size, entry-count, index-filter-analyzer-enabled, index-filter-analyzer-max-entries, parent-suffix-dn, referral-mode, repl-accept-client-update-enabled, repl-cl-max-age, repl-cl-max-entry-count, repl-id, repl-manager-bind-dn, repl-purge-delay, repl-rewrite-referrals-enabled, repl-role, require-index-enabled – DS suffix configuration (SUF) properties

Description

Each Directory Server suffix you create is configured according to the suffix properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: db-name

Syntax	STRING
Default Value	suffixName
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the suffix that is used to process requests involving the database.

PROPERTY: db-path

Syntax	PATH
Default Value	server-instance-dir/db/suffix-dir
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the absolute path to the suffix database.

PROPERTY: entry-cache-count

Syntax	INTEGER | unlimited
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of entries allowed in the entry cache of the suffix.

PROPERTY: entry-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum amount of memory Directory Server requests for the entry cache of the suffix.

PROPERTY: entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the number of entries stored in the suffix.

PROPERTY: index-filter-analyzer-enabled

Syntax	off and on
Default Value	off
Is readable	Yes
Is modifiable	No
Is multi-valued	No
Restart needed	No

This property specifies whether the index filter analyzer is running.

PROPERTY: index-filter-analyzer-max-entries

Syntax	Integer
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No
Restart needed	No

This property specifies the maximum number of entries that the index filter analyzer may contain.

PROPERTY: parent-suffix-dn

Syntax	DN | undefined
Default Value	DN of the parent entry
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the DN of the parent entry for the suffix. The value of this property must logically be a parent of the suffix.

For instance, if you have a suffix with DN dc=com and a suffix dc=example,dc=com, you can set dc=com as the parent-suffix-dn of dc=example,dc=com, and subtree searches with based DN dc=com then also travers dc=example,dc=com.

PROPERTY: referral-mode

Syntax	disabled | enabled | only-on-write
Default Value	disabled
Is readable	Yes
Is modifiable	Yes, if the suffix is not replicated
Is multi-valued	No

This property specifies how referrals are used when a client makes a request involving the suffix.

disabled

Handle requests locally; do not return referral URLs.

enabled

Return referral URLs to client requests.

only-on-write

Return referral URLs to client requests only for write operations.

PROPERTY: repl-accept-client-update-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the replicated suffix accepts write operations from client applications, or instead returns referral URLs.

PROPERTY: repl-cl-max-age

Syntax	DURATION | undefined
Default Value	7d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age for a record in the replication changelog. Older records are purged.

PROPERTY: repl-cl-max-entry-count

Syntax	INTEGER
Default Value	0 (meaning undefined)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the replication changelog. When the limit is exceeded, older records are purged.

PROPERTY: repl-id

Syntax	INTEGER
Default Value	None
Is readable	Yes
Is modifiable	Yes, using the subcommands to manage replication
Is multi-valued	No

This property specifies the replica identification number, 1-65534 for a supplier, 65535 for a consumer or a hub. Once set, this property cannot be modified.

PROPERTY: repl-manager-bind-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the bind DNs of users allowed to bind to perform replication operations on the suffix.

PROPERTY: repl-purge-delay

Syntax	DURATION | never
Default Value	7d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of tombstone entries used by replication. Tombstone entries are entries marked for deletion that have not yet been removed, and also replication state information associated with the entries. When setting this attribute, ensure that the purge delay is longer than the longest replication cycle in your replication policy to avoid incurring conflict resolution problems and divergence between replicas.

PROPERTY: repl-rewrite-referrals-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referrals you set can be automatically overwritten by the server to reference replicas.

PROPERTY: repl-role

Syntax	not-replicated | master | hub | consumer
Default Value	not-replicated
Is readable	Yes
Is modifiable	Yes, using the subcommands to manage replication
Is multi-valued	No

This property specifies the role played by the suffix in a replicated topology.

not-replicated

The suffix is not part of a replicated toplogy.

master

This suffix is a supplier of replication updates in a replicated topology. It can accept both read and write operations.

hub

This suffix is a supplier of replication updates in a replicated topology. It can accept read operations and replication updates.

consumer

This suffix is a dedicated consumer of replication updates in a replicated topology. It can accept read operations and replication updates, but not writes from clients.

To promote a replica, use the dsconf promote-repl command. To demote a replica, use the dsconf demote-repl command.

PROPERTY: require-index-enabled

Syntax	on|off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether unindexed searches are allowed. When on, unindexed searches return LDAP_UNWILLING_TO_PERFORM.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), enabled(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

repl-fractional-exclude-attr(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

repl-agmt, auth-bind-dn, auth-protocol, auth-pwd, repl-fractional-exclude-attr, repl-fractional-include-attr, repl-schedule, transport-compression, transport-group-size, transport-window-size – DS replication agreement configuration (RAG) properties

Description

A replication agreement governs how a Directory Server supplier updates a Directory Server consumer. Although this configuration element is called an agreement, it concerns the configuration only of the supplier.

PROPERTY: auth-bind-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the bind DN used by the supplier to bind to the consumer in order to perform replication-related updates. This bind DN must be present on the consumer.

PROPERTY: auth-protocol

Syntax	clear|ssl-simple|ssl-client
Default Value	clear
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the protocol used by the supplier to bind to the consumer in order to perform replication-related updates. The default is to bind with simple authentication in clear text without securing the connection, as most replications connections are made on an internal network. You may however configure replication to use SSL and simple authentication to protect the connection from malicious snooping, or SSL with client authentication to further protect the connection.

PROPERTY: auth-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password used by the supplier to bind to the consumer. You provide it using auth-pwd-file.

PROPERTY: auth-pwd-file

Syntax	PATH
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the bind password for replication is read to create the replication agreement. The file is read once on replication agreement creation, and the password is stored for future use.

PROPERTY: repl-fractional-exclude-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the list of attributes not to replicate. This property is mutually exclusive with repl-fractional-include-attr.

PROPERTY: repl-fractional-include-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the list of attributes to replicate. This property is mutually exclusive with repl-fractional-exclude-attr.

PROPERTY: repl-schedule

Syntax	INTERVAL | always
Default Value	always
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the times and days when replication can take place.

PROPERTY: transport-compression

Syntax	best-compression | best-speed | default-compression | no-compression
Default Value	no-compression
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the level of libz(3) compression used on replication updates from the supplier to the consumer. Supported settings are as follows.

no-compression

No compression

default-compression

Default zlib compression (zlib numeric value = -1)

best-speed

Fastest zlib compression (zlib numeric value = 1)

best-compression

Strongest zlib compression (zlib numeric value = 9)

If the bottleneck for replication in your environment is network bandwidth, this property can potentially help you tune the replication protocol for better performance.

PROPERTY: transport-group-size

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many replication messages are grouped on the supplier before being sent to the consumer. Valid range is 1 to 255.

If the bottleneck for replication in your environment is network bandwidth, this property can potentially help you tune the replication protocol for better performance.

PROPERTY: transport-window-size

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of replication messages sent from the supplier to the consumer before waiting for a response from the consumer to continue. Valid range is 1 to 65535.

If the bottleneck for replication in your environment is network latency or network bandwidth, this property can potentially help you tune the replication protocol for better performance.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), desc(5dsconf), enabled(5dsconf)

ODSEE 11.1.1.3.0  Last Revised June 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

repl-fractional-include-attr(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

repl-agmt, auth-bind-dn, auth-protocol, auth-pwd, repl-fractional-exclude-attr, repl-fractional-include-attr, repl-schedule, transport-compression, transport-group-size, transport-window-size – DS replication agreement configuration (RAG) properties

Description

A replication agreement governs how a Directory Server supplier updates a Directory Server consumer. Although this configuration element is called an agreement, it concerns the configuration only of the supplier.

PROPERTY: auth-bind-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the bind DN used by the supplier to bind to the consumer in order to perform replication-related updates. This bind DN must be present on the consumer.

PROPERTY: auth-protocol

Syntax	clear|ssl-simple|ssl-client
Default Value	clear
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the protocol used by the supplier to bind to the consumer in order to perform replication-related updates. The default is to bind with simple authentication in clear text without securing the connection, as most replications connections are made on an internal network. You may however configure replication to use SSL and simple authentication to protect the connection from malicious snooping, or SSL with client authentication to further protect the connection.

PROPERTY: auth-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password used by the supplier to bind to the consumer. You provide it using auth-pwd-file.

PROPERTY: auth-pwd-file

Syntax	PATH
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the bind password for replication is read to create the replication agreement. The file is read once on replication agreement creation, and the password is stored for future use.

PROPERTY: repl-fractional-exclude-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the list of attributes not to replicate. This property is mutually exclusive with repl-fractional-include-attr.

PROPERTY: repl-fractional-include-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the list of attributes to replicate. This property is mutually exclusive with repl-fractional-exclude-attr.

PROPERTY: repl-schedule

Syntax	INTERVAL | always
Default Value	always
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the times and days when replication can take place.

PROPERTY: transport-compression

Syntax	best-compression | best-speed | default-compression | no-compression
Default Value	no-compression
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the level of libz(3) compression used on replication updates from the supplier to the consumer. Supported settings are as follows.

no-compression

No compression

default-compression

Default zlib compression (zlib numeric value = -1)

best-speed

Fastest zlib compression (zlib numeric value = 1)

best-compression

Strongest zlib compression (zlib numeric value = 9)

If the bottleneck for replication in your environment is network bandwidth, this property can potentially help you tune the replication protocol for better performance.

PROPERTY: transport-group-size

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many replication messages are grouped on the supplier before being sent to the consumer. Valid range is 1 to 255.

If the bottleneck for replication in your environment is network bandwidth, this property can potentially help you tune the replication protocol for better performance.

PROPERTY: transport-window-size

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of replication messages sent from the supplier to the consumer before waiting for a response from the consumer to continue. Valid range is 1 to 65535.

If the bottleneck for replication in your environment is network latency or network bandwidth, this property can potentially help you tune the replication protocol for better performance.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), desc(5dsconf), enabled(5dsconf)

ODSEE 11.1.1.3.0  Last Revised June 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

replication(5dsconf)

Name | Description | Extended Description | Attributes | See Also

Name

replication, nsDS5Replica, nsDS5ReplicationAgreement, ReplPriorityRule – Directory Server replication configuration

Description

---

Note –

In most cases you do not need to know how to manage the object classes and attributes mentioned here. Instead you handle replication configuration through Directory Service Control Center or the dsconf(1M) command. The information here is included primarily for those of you who are familiar with command-line configuration for replication in previous Directory Server versions.

---

Replication works in Directory Server using extended operations. Changes to a suffix on a supplier server are replayed on the consumer server. Each server stores configuration information defining its role in replication, and defining the user account that has access to perform replication operations. The supplier server also stores configuration information about the replication agreement it has with the consumer.

Replication configuration is reflected in object classes and attributes under cn=config of the Directory Server instance.

Replica Configuration

The configuration entry that indicates a suffix is replicated has a DN of the following form.

cn=replica,cn=suffix name,cn=mapping tree,cn=config

For example, the following configuration entry DN corresponds to the suffix dc=example,dc=com.

cn=replica,cn=dc\=example\,dc\=com,cn=mapping tree,cn=config

Such entries have the object class nsDS5Replica.

Replication Agreement Configuration

The configuration entries that describe replication agreements with other servers have DNs of the following form.

cn=agreement name,cn=replica,cn=suffix name,cn=mapping tree,
 cn=config

For example, the following configuration entry DN corresponds to the suffix dc=example,dc=com.

cn=ds.example.com:389,cn=replica,cn=dc\=example\,dc\=com,
 cn=mapping tree,cn=config

Replication agreement entries have the object class nsDS5ReplicationAgreement.

Replication Priority Configuration

The configuration entries that describe replication priority rules have DNs of the form:

cn=rule name,cn=replica,cn=suffix name,cn=mapping tree,
 cn=config

For example, the following configuration entry DN corresponds to the suffix dc=example,dc=com.

cn=pwdReplPrio,cn=replica,cn=dc\=example\,dc\=com,cn=mapping tree,
 cn=config

Replication priority rule entries have the object class ReplPriorityRule.

Replication Manager Configuration

The configuration entry for the account used to bind and perform replication has, by default, the DN:

cn=replication manager,cn=replication,cn=config

The account entry is a standard person(5dsoc) object class. It defines the DN and userPassword for replication. The password policy for the account used to bind and perform replication has, by default, the DN:

cn=Password Policy,cn=replication manager,cn=replication,
 cn=config

The password policy entry is governed by the schema for pwpolicy(5dssd). As both person and pwpolicy related object classes and attribute types are described elsewhere, they are not further described here.

Extended Description

This section examines replication configuration on a master supplier server, and on a dedicated consumer server. The sample configurations shown here were created using the dsconf to configure replication.

Supplier Side Configuration

On the supplier side, the key configuration entries are the replica configuration and the replication agreement.

Supplier Replica Configuration

For a master supplier, an nsDS5Replica configuration entry looks something like the following:

dn: cn=replica,cn=\dc=example\,dc\=com,cn=mapping tree,cn=config
nsDS5ReplicaRoot: dc=example,dc=com
nsDS5ReplicaBindDN: cn=replication manager,cn=replication,cn=config
objectClass: top
objectClass: nsDS5Replica
nsDS5ReplicaId: 1
nsDS5Flags: 1
nsDS5ReplicaType: 3
cn: replica
creatorsName: cn=directory manager
modifiersName: cn=directory manager
nsState:: AAEAAAAAAAAAAAAAQ4rs0AAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAA==
nsDS5ReplicaName: d2e14d02-600311da-80ace5db-c83e55ac
numSubordinates: 1

In this example, the key attributes are the following:

nsDS5ReplicaRoot

Holds the DN of the root of the replicated suffix. Once set, it must not be modified.

nsDS5ReplicaBindDN

Holds the DN of the account used to bind for replication. If replication is performed over SSL, this attribute can hold the certificate identity associated with the DN.

nsDS5ReplicaId

Specifies the unique ID of this master supplier server, a value from 1-65534, inclusive.

A hub uses the same replica ID as a consumer, 65535.

nsDS5Flags

Governs change logging and automatic referrals. It takes one of the following values:

0

No changes are logged. Automatic referrals are not overwritten.

1

Changes are logged. Automatic referrals are not overwritten.

4

No changes are logged. Automatic referrals are overwritten.

5

Changes are logged. Automatic referrals are overwritten.

nsDS5ReplicaType

Defines the role this replica plays in replicating with other servers. It takes one of the following values:

0

Reserved for internal use

1

Dedicated supplier

2

Dedicated consumer (read-only)

3

Supplier/consumer (read-write)

cn

This attribute names the replica. Once set, it must not be modified.

nsState

Stores the state of the clock for handling synchronization. Reserved for internal use.

nsDS5ReplicaName

Read-only unique identifier for the replica.

The replica configuration entry can also hold the following attributes not shown here:

ds5BeginReplicaAcceptUpdates(5dsconf)

ds5ReplicaConsumerTimeout(5dsconf)

ds5LastInitTimeStamp(5dsconf)

ds5ReferralDelayAfterInit(5dsconf)

dsChangelogMaxAge(5dsconf)

dsChangelogMaxentries(5dsconf)

dsFilterSPConfigchecksum(5dsconf)

nsDS5ReplicaAutoReferral(5dsconf)

nsDS5ReplicaChangeCount(5dsconf)

nsDS5ReplicaPurgeDelay(5dsconf)

nsDS5ReplicaReferral(5dsconf)

nsDS5ReplicaTombstonePurgeInterval(5dsconf)

nsDS5Task(5dsconf)

Supplier Replication Agreement

For a master supplier, an nsDS5ReplicationAgreement configuration entry looks something like the following:

dn: cn=ds.example.com:389,cn=replica,cn=dc\=example\,dc\=com,
 cn=mapping tree,cn=config
nsDS5ReplicaHost: ds.example.com
nsDS5ReplicaUpdateSchedule: *
nsDS5ReplicaTransportInfo: LDAP
objectClass: top
objectClass: nsDS5ReplicationAgreement
nsDS5ReplicaPort: 389
nsDS5ReplicaBindMethod: SIMPLE
cn: ds.example.com:389
nsDS5ReplicaRoot: dc=example,dc=com
nsDS5ReplicaBindDN: cn=replication manager,cn=replication,
 cn=config
nsDS5ReplicaCredentials:: e0RFU31JakduS3VZSWhEcThEcExDQlU2
 VlN2QTdjcUw4emhDdXl3Sldmc3NTZ2t3eS9mWmR4VmpUZlVYRE1NLzR2T
 UVBDQpyZVdYU3A3U1ZwYz0=

In this example, the key attributes are the following:

nsDS5ReplicaHost

Holds the host name where the consumer runs.

nsDS5ReplicaUpdateSchedule

Specifies when replication happens. If you must restrict the time when replication can happen, set this attribute. This attribute can take multiple values of the form hhmm-hhmm 0123456, where the first element specifies the time span, and the second specifies which days, starting with Sunday (0) to Saturday (6).

nsDS5ReplicaTransportInfo

Specifies the transport used for replication, LDAP or SSL.

nsDS5ReplicaPort

Holds port number on which the consumer listens.

cn

This attribute names the replication agreement. Once set, it must not be modified.

nsDS5ReplicaBindMethod

Specifies bind protocol, SIMPLE, SSLCLIENTAUTH.

nsDS5ReplicaRoot

Holds the DN of the root of the replicated suffix. Once set, it must not be modified.

nsDS5ReplicaBindDN

Holds the DN of the account on the consumer used for replication.

nsDS5ReplicaCredentials

Holds the bind credentials of the account on the consumer used for replication.

The replication agreement entry can also hold the following attributes not shown here:

description(5dsat)

ds5AgreementEnable(5dsconf)

ds5ReplicaAutomaticInit(5dsconf)

ds5ReplicaTransportCompressionLevel(5dsconf)

ds5ReplicaTransportConcurrencyLevel(5dsconf)

ds5ReplicaTransportGroupSize(5dsconf)

ds5ReplicaTransportGrpPktSize(5dsconf)

ds5ReplicaTransportWindowSize(5dsconf)

ds6ruv(5dsconf)

dsReplFractionalExclude(5dsconf)

dsReplFractionalInclude(5dsconf)

nsDS5ReplicaUpdateSchedule(5dsconf)

nsds50ruv(5dsconf)

nsds5BeginReplicaRefresh(5dsconf)

nsds5ReplicaTimeout(5dsconf)

nsds5replicaChangesSentSinceStartup(5dsconf)

nsds5replicaLastInitEnd(5dsconf)

nsds5replicaLastInitStart(5dsconf)

nsds5replicaLastInitStatus(5dsconf)

nsds5replicaLastUpdateEnd(5dsconf)

nsds5replicaLastUpdateStart(5dsconf)

nsds5replicaLastUpdateStatus(5dsconf)

nsds5replicaUpdateInProgress(5dsconf)

Supplier Priority Rule

For a master supplier, a ReplPriorityRule configuration entry looks something like the following:

dn: cn=pwdReplPrio,cn=replica,cn=dc\=example\,dc\=com,cn=mapping tree,cn=config
objectClass: top
objectClass: ReplPriorityRule
replPriorityType: mod
replPriorityAttribute: userPassword
nsDS5ReplicaRoot: dc=example,dc=com
cn: pwdReplPrio

In this example, the key attributes are the following:

replPriorityType

Specifies the type of operation which are replicated with high priority.

replPriorityAttribute

Specifies the attribute whose changes are replicated with high priority.

nsDS5ReplicaRoot

Holds the DN of the root of the replicated suffix to which this priority rule applies.

cn

This attribute names the priority rule.

The replication priority rule entry can also hold the following attributes not shown here:

replPriorityBaseDN(5dsconf)

replPriorityBindDN(5dsconf)

Consumer Side Configuration

On the consumer side, the key configuration entry is the replica configuration. On a dedicated consumer, it is also useful to see how the mapping tree entry for the suffix is configured to refer updates to the supplier.

Consumer Replica Configuration

For a dedicated consumer, an nsDS5Replica configuration entry looks something like the following:

dn: cn=replica,cn=dc\=example\,dc\=com,cn=mapping tree,cn=config
nsDS5ReplicaRoot: dc=example,dc=com
nsDS5ReplicaBindDN: cn=replication manager,cn=replication,cn=config
objectClass: top
objectClass: nsDS5Replica
nsDS5Flags: 0
nsDS5ReplicaType: 2
cn: replica
nsDS5ReplicaId: 65535
nsState:: //8AAAAAAAAAAAAAQ4rtPAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAA==
nsDS5ReplicaName: 07ed9f82-600411da-8096d729-0ba76005
dsFilterSPConfigchecksum: 0
ds5LastInitTimeStamp: 0

Key attributes in this example are explained in Supplier Replica Configuration.

A hub uses the same replica ID as a consumer, 65535.

Referrals On Consumer

For a dedicated consumer suffix, the mapping tree configuration entry refers client applications to the supplier for write operations:

dn: cn=dc\=example\,dc\=com,cn=mapping tree,cn=config
objectClass: top
objectClass: extensibleObject
objectClass: nsMappingTree
nsslapd-backend: example
cn: dc=example,dc=com
numSubordinates: 1
nsslapd-referral: ldap://master.example.com:389/dc%3Dexample,dc%3Dcom
nsslapd-state: referral on update

Notice that the nsslapd-referral attribute refers clients to the master on host master.example.com and port 389 when they request update operations that would write to the directory. These attributes are set by the server when replication is initialized. The dedicated consumer then accepts write operations only from the supplier replica.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dsconf(1M), person(5dsoc), pwpolicy(5dssd)

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Extended Description | Attributes | See Also

repl-id(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

suffix, db-name, entry-cache-count, entry-cache-size, entry-count, index-filter-analyzer-enabled, index-filter-analyzer-max-entries, parent-suffix-dn, referral-mode, repl-accept-client-update-enabled, repl-cl-max-age, repl-cl-max-entry-count, repl-id, repl-manager-bind-dn, repl-purge-delay, repl-rewrite-referrals-enabled, repl-role, require-index-enabled – DS suffix configuration (SUF) properties

Description

Each Directory Server suffix you create is configured according to the suffix properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: db-name

Syntax	STRING
Default Value	suffixName
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the suffix that is used to process requests involving the database.

PROPERTY: db-path

Syntax	PATH
Default Value	server-instance-dir/db/suffix-dir
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the absolute path to the suffix database.

PROPERTY: entry-cache-count

Syntax	INTEGER | unlimited
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of entries allowed in the entry cache of the suffix.

PROPERTY: entry-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum amount of memory Directory Server requests for the entry cache of the suffix.

PROPERTY: entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the number of entries stored in the suffix.

PROPERTY: index-filter-analyzer-enabled

Syntax	off and on
Default Value	off
Is readable	Yes
Is modifiable	No
Is multi-valued	No
Restart needed	No

This property specifies whether the index filter analyzer is running.

PROPERTY: index-filter-analyzer-max-entries

Syntax	Integer
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No
Restart needed	No

This property specifies the maximum number of entries that the index filter analyzer may contain.

PROPERTY: parent-suffix-dn

Syntax	DN | undefined
Default Value	DN of the parent entry
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the DN of the parent entry for the suffix. The value of this property must logically be a parent of the suffix.

For instance, if you have a suffix with DN dc=com and a suffix dc=example,dc=com, you can set dc=com as the parent-suffix-dn of dc=example,dc=com, and subtree searches with based DN dc=com then also travers dc=example,dc=com.

PROPERTY: referral-mode

Syntax	disabled | enabled | only-on-write
Default Value	disabled
Is readable	Yes
Is modifiable	Yes, if the suffix is not replicated
Is multi-valued	No

This property specifies how referrals are used when a client makes a request involving the suffix.

disabled

Handle requests locally; do not return referral URLs.

enabled

Return referral URLs to client requests.

only-on-write

Return referral URLs to client requests only for write operations.

PROPERTY: repl-accept-client-update-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the replicated suffix accepts write operations from client applications, or instead returns referral URLs.

PROPERTY: repl-cl-max-age

Syntax	DURATION | undefined
Default Value	7d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age for a record in the replication changelog. Older records are purged.

PROPERTY: repl-cl-max-entry-count

Syntax	INTEGER
Default Value	0 (meaning undefined)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the replication changelog. When the limit is exceeded, older records are purged.

PROPERTY: repl-id

Syntax	INTEGER
Default Value	None
Is readable	Yes
Is modifiable	Yes, using the subcommands to manage replication
Is multi-valued	No

This property specifies the replica identification number, 1-65534 for a supplier, 65535 for a consumer or a hub. Once set, this property cannot be modified.

PROPERTY: repl-manager-bind-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the bind DNs of users allowed to bind to perform replication operations on the suffix.

PROPERTY: repl-purge-delay

Syntax	DURATION | never
Default Value	7d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of tombstone entries used by replication. Tombstone entries are entries marked for deletion that have not yet been removed, and also replication state information associated with the entries. When setting this attribute, ensure that the purge delay is longer than the longest replication cycle in your replication policy to avoid incurring conflict resolution problems and divergence between replicas.

PROPERTY: repl-rewrite-referrals-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referrals you set can be automatically overwritten by the server to reference replicas.

PROPERTY: repl-role

Syntax	not-replicated | master | hub | consumer
Default Value	not-replicated
Is readable	Yes
Is modifiable	Yes, using the subcommands to manage replication
Is multi-valued	No

This property specifies the role played by the suffix in a replicated topology.

not-replicated

The suffix is not part of a replicated toplogy.

master

This suffix is a supplier of replication updates in a replicated topology. It can accept both read and write operations.

hub

This suffix is a supplier of replication updates in a replicated topology. It can accept read operations and replication updates.

consumer

This suffix is a dedicated consumer of replication updates in a replicated topology. It can accept read operations and replication updates, but not writes from clients.

To promote a replica, use the dsconf promote-repl command. To demote a replica, use the dsconf demote-repl command.

PROPERTY: require-index-enabled

Syntax	on|off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether unindexed searches are allowed. When on, unindexed searches return LDAP_UNWILLING_TO_PERFORM.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), enabled(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

repl-manager-bind-dn(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

suffix, db-name, entry-cache-count, entry-cache-size, entry-count, index-filter-analyzer-enabled, index-filter-analyzer-max-entries, parent-suffix-dn, referral-mode, repl-accept-client-update-enabled, repl-cl-max-age, repl-cl-max-entry-count, repl-id, repl-manager-bind-dn, repl-purge-delay, repl-rewrite-referrals-enabled, repl-role, require-index-enabled – DS suffix configuration (SUF) properties

Description

Each Directory Server suffix you create is configured according to the suffix properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: db-name

Syntax	STRING
Default Value	suffixName
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the suffix that is used to process requests involving the database.

PROPERTY: db-path

Syntax	PATH
Default Value	server-instance-dir/db/suffix-dir
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the absolute path to the suffix database.

PROPERTY: entry-cache-count

Syntax	INTEGER | unlimited
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of entries allowed in the entry cache of the suffix.

PROPERTY: entry-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum amount of memory Directory Server requests for the entry cache of the suffix.

PROPERTY: entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the number of entries stored in the suffix.

PROPERTY: index-filter-analyzer-enabled

Syntax	off and on
Default Value	off
Is readable	Yes
Is modifiable	No
Is multi-valued	No
Restart needed	No

This property specifies whether the index filter analyzer is running.

PROPERTY: index-filter-analyzer-max-entries

Syntax	Integer
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No
Restart needed	No

This property specifies the maximum number of entries that the index filter analyzer may contain.

PROPERTY: parent-suffix-dn

Syntax	DN | undefined
Default Value	DN of the parent entry
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the DN of the parent entry for the suffix. The value of this property must logically be a parent of the suffix.

For instance, if you have a suffix with DN dc=com and a suffix dc=example,dc=com, you can set dc=com as the parent-suffix-dn of dc=example,dc=com, and subtree searches with based DN dc=com then also travers dc=example,dc=com.

PROPERTY: referral-mode

Syntax	disabled | enabled | only-on-write
Default Value	disabled
Is readable	Yes
Is modifiable	Yes, if the suffix is not replicated
Is multi-valued	No

This property specifies how referrals are used when a client makes a request involving the suffix.

disabled

Handle requests locally; do not return referral URLs.

enabled

Return referral URLs to client requests.

only-on-write

Return referral URLs to client requests only for write operations.

PROPERTY: repl-accept-client-update-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the replicated suffix accepts write operations from client applications, or instead returns referral URLs.

PROPERTY: repl-cl-max-age

Syntax	DURATION | undefined
Default Value	7d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age for a record in the replication changelog. Older records are purged.

PROPERTY: repl-cl-max-entry-count

Syntax	INTEGER
Default Value	0 (meaning undefined)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the replication changelog. When the limit is exceeded, older records are purged.

PROPERTY: repl-id

Syntax	INTEGER
Default Value	None
Is readable	Yes
Is modifiable	Yes, using the subcommands to manage replication
Is multi-valued	No

This property specifies the replica identification number, 1-65534 for a supplier, 65535 for a consumer or a hub. Once set, this property cannot be modified.

PROPERTY: repl-manager-bind-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the bind DNs of users allowed to bind to perform replication operations on the suffix.

PROPERTY: repl-purge-delay

Syntax	DURATION | never
Default Value	7d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of tombstone entries used by replication. Tombstone entries are entries marked for deletion that have not yet been removed, and also replication state information associated with the entries. When setting this attribute, ensure that the purge delay is longer than the longest replication cycle in your replication policy to avoid incurring conflict resolution problems and divergence between replicas.

PROPERTY: repl-rewrite-referrals-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referrals you set can be automatically overwritten by the server to reference replicas.

PROPERTY: repl-role

Syntax	not-replicated | master | hub | consumer
Default Value	not-replicated
Is readable	Yes
Is modifiable	Yes, using the subcommands to manage replication
Is multi-valued	No

This property specifies the role played by the suffix in a replicated topology.

not-replicated

The suffix is not part of a replicated toplogy.

master

This suffix is a supplier of replication updates in a replicated topology. It can accept both read and write operations.

hub

This suffix is a supplier of replication updates in a replicated topology. It can accept read operations and replication updates.

consumer

This suffix is a dedicated consumer of replication updates in a replicated topology. It can accept read operations and replication updates, but not writes from clients.

To promote a replica, use the dsconf promote-repl command. To demote a replica, use the dsconf demote-repl command.

PROPERTY: require-index-enabled

Syntax	on|off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether unindexed searches are allowed. When on, unindexed searches return LDAP_UNWILLING_TO_PERFORM.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), enabled(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

repl-priority(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

repl-priority, attr, base-dn, bind-dn, op-type – DS prioritized replication configuration (RPR) properties

Description

Prioritized replication lets you force a Directory Server supplier to assign higher priority to certain updates replicated on a Directory Server consumer. You prioritize replication operations by creating replication priority rules.

PROPERTY: attr

Syntax	ATTR_NAME
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the attribute type to which the replication priority rule applies.

PROPERTY: base-dn

Syntax	DN
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the DN under which the replication priority rule applies. For example, if you set base-dn:ou=administrators,dc=example,dc=com, then changes to uid=myAdmin,ou=administrators,dc=example,dc=com might be replicated with high priority, but changes to uid=bjensen,ou=people,dc=example,dc=com would not.

PROPERTY: bind-dn

Syntax	DN
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a bind DN for an account whose updates might be replicated with high priority.

PROPERTY: op-type

Syntax	add | mod | del
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a type of operation for which updates might be replicated with high priority.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M)

ODSEE 11.1.1.3.0  Last Revised June 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

replPriorityAttribute(5dsconf)

Name | Description | Examples | Attributes | See Also

Name

replPriorityAttribute – Attribute to replicate with high priority

Description

PROPERTY	VALUE
Entry DN	cn=rule name,cn=replica,cn=suffix name,cn=mapping tree,cn=config
Valid Range	Any valid attribute type
Default Value	N/A
Syntax	DirectoryString

This attribute is part of replica configuration for ReplPriorityRule entries.

When this multi-valued attribute is set, the server replicates changes to the attribute you specify with high priority.

Examples

replPriorityAttribute: userPassword

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

replication(5dsconf)

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Examples | Attributes | See Also

replPriorityBaseDN(5dsconf)

Name | Description | Examples | Attributes | See Also

Name

replPriorityBaseDN – Replicate changes under this base with high priority

Description

PROPERTY	VALUE
Entry DN	cn=rule name,cn=replica,cn=suffix name,cn=mapping tree,cn=config
Valid Range	Any valid DN inside the replicated suffix
Default Value	N/A
Syntax	DirectoryString

This attribute is part of replica configuration for ReplPriorityRule entries.

When this attribute is set, the server replicates changes to entries under the specified DN with high priority.

Examples

replPriorityBaseDN: ou=people,dc=example,dc=com

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

replication(5dsconf)

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Examples | Attributes | See Also

replPriorityBindDN(5dsconf)

Name | Description | Examples | Attributes | See Also

Name

replPriorityBindDN – Replicate changes performed by this user with high priority

Description

PROPERTY	VALUE
Entry DN	cn=rule name,cn=replica,cn=suffix name,cn=mapping tree,cn=config
Valid Range	Any valid DN
Default Value	N/A
Syntax	DirectoryString

This attribute is part of replica configuration for ReplPriorityRule entries.

When this attribute is set, the server replicates changes made by the user having the specified bind DN with high priority.

Examples

replPriorityBindDN: uid=admin,ou=Administrators,dc=example,dc=com

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

replication(5dsconf)

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Examples | Attributes | See Also

ReplPriorityRule(5dsconf)

Name | Description | Extended Description | Attributes | See Also

Name

replication, nsDS5Replica, nsDS5ReplicationAgreement, ReplPriorityRule – Directory Server replication configuration

Description

---

Note –

In most cases you do not need to know how to manage the object classes and attributes mentioned here. Instead you handle replication configuration through Directory Service Control Center or the dsconf(1M) command. The information here is included primarily for those of you who are familiar with command-line configuration for replication in previous Directory Server versions.

---

Replication works in Directory Server using extended operations. Changes to a suffix on a supplier server are replayed on the consumer server. Each server stores configuration information defining its role in replication, and defining the user account that has access to perform replication operations. The supplier server also stores configuration information about the replication agreement it has with the consumer.

Replication configuration is reflected in object classes and attributes under cn=config of the Directory Server instance.

Replica Configuration

The configuration entry that indicates a suffix is replicated has a DN of the following form.

cn=replica,cn=suffix name,cn=mapping tree,cn=config

For example, the following configuration entry DN corresponds to the suffix dc=example,dc=com.

cn=replica,cn=dc\=example\,dc\=com,cn=mapping tree,cn=config

Such entries have the object class nsDS5Replica.

Replication Agreement Configuration

The configuration entries that describe replication agreements with other servers have DNs of the following form.

cn=agreement name,cn=replica,cn=suffix name,cn=mapping tree,
 cn=config

For example, the following configuration entry DN corresponds to the suffix dc=example,dc=com.

cn=ds.example.com:389,cn=replica,cn=dc\=example\,dc\=com,
 cn=mapping tree,cn=config

Replication agreement entries have the object class nsDS5ReplicationAgreement.

Replication Priority Configuration

The configuration entries that describe replication priority rules have DNs of the form:

cn=rule name,cn=replica,cn=suffix name,cn=mapping tree,
 cn=config

For example, the following configuration entry DN corresponds to the suffix dc=example,dc=com.

cn=pwdReplPrio,cn=replica,cn=dc\=example\,dc\=com,cn=mapping tree,
 cn=config

Replication priority rule entries have the object class ReplPriorityRule.

Replication Manager Configuration

The configuration entry for the account used to bind and perform replication has, by default, the DN:

cn=replication manager,cn=replication,cn=config

The account entry is a standard person(5dsoc) object class. It defines the DN and userPassword for replication. The password policy for the account used to bind and perform replication has, by default, the DN:

cn=Password Policy,cn=replication manager,cn=replication,
 cn=config

The password policy entry is governed by the schema for pwpolicy(5dssd). As both person and pwpolicy related object classes and attribute types are described elsewhere, they are not further described here.

Extended Description

This section examines replication configuration on a master supplier server, and on a dedicated consumer server. The sample configurations shown here were created using the dsconf to configure replication.

Supplier Side Configuration

On the supplier side, the key configuration entries are the replica configuration and the replication agreement.

Supplier Replica Configuration

For a master supplier, an nsDS5Replica configuration entry looks something like the following:

dn: cn=replica,cn=\dc=example\,dc\=com,cn=mapping tree,cn=config
nsDS5ReplicaRoot: dc=example,dc=com
nsDS5ReplicaBindDN: cn=replication manager,cn=replication,cn=config
objectClass: top
objectClass: nsDS5Replica
nsDS5ReplicaId: 1
nsDS5Flags: 1
nsDS5ReplicaType: 3
cn: replica
creatorsName: cn=directory manager
modifiersName: cn=directory manager
nsState:: AAEAAAAAAAAAAAAAQ4rs0AAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAA==
nsDS5ReplicaName: d2e14d02-600311da-80ace5db-c83e55ac
numSubordinates: 1

In this example, the key attributes are the following:

nsDS5ReplicaRoot

Holds the DN of the root of the replicated suffix. Once set, it must not be modified.

nsDS5ReplicaBindDN

Holds the DN of the account used to bind for replication. If replication is performed over SSL, this attribute can hold the certificate identity associated with the DN.

nsDS5ReplicaId

Specifies the unique ID of this master supplier server, a value from 1-65534, inclusive.

A hub uses the same replica ID as a consumer, 65535.

nsDS5Flags

Governs change logging and automatic referrals. It takes one of the following values:

0

No changes are logged. Automatic referrals are not overwritten.

1

Changes are logged. Automatic referrals are not overwritten.

4

No changes are logged. Automatic referrals are overwritten.

5

Changes are logged. Automatic referrals are overwritten.

nsDS5ReplicaType

Defines the role this replica plays in replicating with other servers. It takes one of the following values:

0

Reserved for internal use

1

Dedicated supplier

2

Dedicated consumer (read-only)

3

Supplier/consumer (read-write)

cn

This attribute names the replica. Once set, it must not be modified.

nsState

Stores the state of the clock for handling synchronization. Reserved for internal use.

nsDS5ReplicaName

Read-only unique identifier for the replica.

The replica configuration entry can also hold the following attributes not shown here:

ds5BeginReplicaAcceptUpdates(5dsconf)

ds5ReplicaConsumerTimeout(5dsconf)

ds5LastInitTimeStamp(5dsconf)

ds5ReferralDelayAfterInit(5dsconf)

dsChangelogMaxAge(5dsconf)

dsChangelogMaxentries(5dsconf)

dsFilterSPConfigchecksum(5dsconf)

nsDS5ReplicaAutoReferral(5dsconf)

nsDS5ReplicaChangeCount(5dsconf)

nsDS5ReplicaPurgeDelay(5dsconf)

nsDS5ReplicaReferral(5dsconf)

nsDS5ReplicaTombstonePurgeInterval(5dsconf)

nsDS5Task(5dsconf)

Supplier Replication Agreement

For a master supplier, an nsDS5ReplicationAgreement configuration entry looks something like the following:

dn: cn=ds.example.com:389,cn=replica,cn=dc\=example\,dc\=com,
 cn=mapping tree,cn=config
nsDS5ReplicaHost: ds.example.com
nsDS5ReplicaUpdateSchedule: *
nsDS5ReplicaTransportInfo: LDAP
objectClass: top
objectClass: nsDS5ReplicationAgreement
nsDS5ReplicaPort: 389
nsDS5ReplicaBindMethod: SIMPLE
cn: ds.example.com:389
nsDS5ReplicaRoot: dc=example,dc=com
nsDS5ReplicaBindDN: cn=replication manager,cn=replication,
 cn=config
nsDS5ReplicaCredentials:: e0RFU31JakduS3VZSWhEcThEcExDQlU2
 VlN2QTdjcUw4emhDdXl3Sldmc3NTZ2t3eS9mWmR4VmpUZlVYRE1NLzR2T
 UVBDQpyZVdYU3A3U1ZwYz0=

In this example, the key attributes are the following:

nsDS5ReplicaHost

Holds the host name where the consumer runs.

nsDS5ReplicaUpdateSchedule

Specifies when replication happens. If you must restrict the time when replication can happen, set this attribute. This attribute can take multiple values of the form hhmm-hhmm 0123456, where the first element specifies the time span, and the second specifies which days, starting with Sunday (0) to Saturday (6).

nsDS5ReplicaTransportInfo

Specifies the transport used for replication, LDAP or SSL.

nsDS5ReplicaPort

Holds port number on which the consumer listens.

cn

This attribute names the replication agreement. Once set, it must not be modified.

nsDS5ReplicaBindMethod

Specifies bind protocol, SIMPLE, SSLCLIENTAUTH.

nsDS5ReplicaRoot

Holds the DN of the root of the replicated suffix. Once set, it must not be modified.

nsDS5ReplicaBindDN

Holds the DN of the account on the consumer used for replication.

nsDS5ReplicaCredentials

Holds the bind credentials of the account on the consumer used for replication.

The replication agreement entry can also hold the following attributes not shown here:

description(5dsat)

ds5AgreementEnable(5dsconf)

ds5ReplicaAutomaticInit(5dsconf)

ds5ReplicaTransportCompressionLevel(5dsconf)

ds5ReplicaTransportConcurrencyLevel(5dsconf)

ds5ReplicaTransportGroupSize(5dsconf)

ds5ReplicaTransportGrpPktSize(5dsconf)

ds5ReplicaTransportWindowSize(5dsconf)

ds6ruv(5dsconf)

dsReplFractionalExclude(5dsconf)

dsReplFractionalInclude(5dsconf)

nsDS5ReplicaUpdateSchedule(5dsconf)

nsds50ruv(5dsconf)

nsds5BeginReplicaRefresh(5dsconf)

nsds5ReplicaTimeout(5dsconf)

nsds5replicaChangesSentSinceStartup(5dsconf)

nsds5replicaLastInitEnd(5dsconf)

nsds5replicaLastInitStart(5dsconf)

nsds5replicaLastInitStatus(5dsconf)

nsds5replicaLastUpdateEnd(5dsconf)

nsds5replicaLastUpdateStart(5dsconf)

nsds5replicaLastUpdateStatus(5dsconf)

nsds5replicaUpdateInProgress(5dsconf)

Supplier Priority Rule

For a master supplier, a ReplPriorityRule configuration entry looks something like the following:

dn: cn=pwdReplPrio,cn=replica,cn=dc\=example\,dc\=com,cn=mapping tree,cn=config
objectClass: top
objectClass: ReplPriorityRule
replPriorityType: mod
replPriorityAttribute: userPassword
nsDS5ReplicaRoot: dc=example,dc=com
cn: pwdReplPrio

In this example, the key attributes are the following:

replPriorityType

Specifies the type of operation which are replicated with high priority.

replPriorityAttribute

Specifies the attribute whose changes are replicated with high priority.

nsDS5ReplicaRoot

Holds the DN of the root of the replicated suffix to which this priority rule applies.

cn

This attribute names the priority rule.

The replication priority rule entry can also hold the following attributes not shown here:

replPriorityBaseDN(5dsconf)

replPriorityBindDN(5dsconf)

Consumer Side Configuration

On the consumer side, the key configuration entry is the replica configuration. On a dedicated consumer, it is also useful to see how the mapping tree entry for the suffix is configured to refer updates to the supplier.

Consumer Replica Configuration

For a dedicated consumer, an nsDS5Replica configuration entry looks something like the following:

dn: cn=replica,cn=dc\=example\,dc\=com,cn=mapping tree,cn=config
nsDS5ReplicaRoot: dc=example,dc=com
nsDS5ReplicaBindDN: cn=replication manager,cn=replication,cn=config
objectClass: top
objectClass: nsDS5Replica
nsDS5Flags: 0
nsDS5ReplicaType: 2
cn: replica
nsDS5ReplicaId: 65535
nsState:: //8AAAAAAAAAAAAAQ4rtPAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAA==
nsDS5ReplicaName: 07ed9f82-600411da-8096d729-0ba76005
dsFilterSPConfigchecksum: 0
ds5LastInitTimeStamp: 0

Key attributes in this example are explained in Supplier Replica Configuration.

A hub uses the same replica ID as a consumer, 65535.

Referrals On Consumer

For a dedicated consumer suffix, the mapping tree configuration entry refers client applications to the supplier for write operations:

dn: cn=dc\=example\,dc\=com,cn=mapping tree,cn=config
objectClass: top
objectClass: extensibleObject
objectClass: nsMappingTree
nsslapd-backend: example
cn: dc=example,dc=com
numSubordinates: 1
nsslapd-referral: ldap://master.example.com:389/dc%3Dexample,dc%3Dcom
nsslapd-state: referral on update

Notice that the nsslapd-referral attribute refers clients to the master on host master.example.com and port 389 when they request update operations that would write to the directory. These attributes are set by the server when replication is initialized. The dedicated consumer then accepts write operations only from the supplier replica.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dsconf(1M), person(5dsoc), pwpolicy(5dssd)

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Extended Description | Attributes | See Also

replPriorityType(5dsconf)

Name | Description | Examples | Attributes | See Also

Name

replPriorityType – Operation type to replicate with high priority

Description

PROPERTY	VALUE
Entry DN	cn=rule name,cn=replica,cn=suffix name,cn=mapping tree,cn=config
Valid Range	add | del | mod
Default Value	All update operations
Syntax	DirectoryString

This attribute is part of replica configuration for ReplPriorityRule entries.

When this attribute is set, the server replicates changes of the type you specify with high priority as follows:

add

Additions and deletions are replicated with high priority.

del

Deletions are replicated with high priority.

mod

Modifications are replicated with high priority.

Examples

replPriorityType: mod

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

replication(5dsconf)

ODSEE 11.1.1.3.0  Last Revised Jan. 8, 2007

Name | Description | Examples | Attributes | See Also

repl-purge-delay(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

suffix, db-name, entry-cache-count, entry-cache-size, entry-count, index-filter-analyzer-enabled, index-filter-analyzer-max-entries, parent-suffix-dn, referral-mode, repl-accept-client-update-enabled, repl-cl-max-age, repl-cl-max-entry-count, repl-id, repl-manager-bind-dn, repl-purge-delay, repl-rewrite-referrals-enabled, repl-role, require-index-enabled – DS suffix configuration (SUF) properties

Description

Each Directory Server suffix you create is configured according to the suffix properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: db-name

Syntax	STRING
Default Value	suffixName
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the suffix that is used to process requests involving the database.

PROPERTY: db-path

Syntax	PATH
Default Value	server-instance-dir/db/suffix-dir
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the absolute path to the suffix database.

PROPERTY: entry-cache-count

Syntax	INTEGER | unlimited
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of entries allowed in the entry cache of the suffix.

PROPERTY: entry-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum amount of memory Directory Server requests for the entry cache of the suffix.

PROPERTY: entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the number of entries stored in the suffix.

PROPERTY: index-filter-analyzer-enabled

Syntax	off and on
Default Value	off
Is readable	Yes
Is modifiable	No
Is multi-valued	No
Restart needed	No

This property specifies whether the index filter analyzer is running.

PROPERTY: index-filter-analyzer-max-entries

Syntax	Integer
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No
Restart needed	No

This property specifies the maximum number of entries that the index filter analyzer may contain.

PROPERTY: parent-suffix-dn

Syntax	DN | undefined
Default Value	DN of the parent entry
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the DN of the parent entry for the suffix. The value of this property must logically be a parent of the suffix.

For instance, if you have a suffix with DN dc=com and a suffix dc=example,dc=com, you can set dc=com as the parent-suffix-dn of dc=example,dc=com, and subtree searches with based DN dc=com then also travers dc=example,dc=com.

PROPERTY: referral-mode

Syntax	disabled | enabled | only-on-write
Default Value	disabled
Is readable	Yes
Is modifiable	Yes, if the suffix is not replicated
Is multi-valued	No

This property specifies how referrals are used when a client makes a request involving the suffix.

disabled

Handle requests locally; do not return referral URLs.

enabled

Return referral URLs to client requests.

only-on-write

Return referral URLs to client requests only for write operations.

PROPERTY: repl-accept-client-update-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the replicated suffix accepts write operations from client applications, or instead returns referral URLs.

PROPERTY: repl-cl-max-age

Syntax	DURATION | undefined
Default Value	7d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age for a record in the replication changelog. Older records are purged.

PROPERTY: repl-cl-max-entry-count

Syntax	INTEGER
Default Value	0 (meaning undefined)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the replication changelog. When the limit is exceeded, older records are purged.

PROPERTY: repl-id

Syntax	INTEGER
Default Value	None
Is readable	Yes
Is modifiable	Yes, using the subcommands to manage replication
Is multi-valued	No

This property specifies the replica identification number, 1-65534 for a supplier, 65535 for a consumer or a hub. Once set, this property cannot be modified.

PROPERTY: repl-manager-bind-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the bind DNs of users allowed to bind to perform replication operations on the suffix.

PROPERTY: repl-purge-delay

Syntax	DURATION | never
Default Value	7d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of tombstone entries used by replication. Tombstone entries are entries marked for deletion that have not yet been removed, and also replication state information associated with the entries. When setting this attribute, ensure that the purge delay is longer than the longest replication cycle in your replication policy to avoid incurring conflict resolution problems and divergence between replicas.

PROPERTY: repl-rewrite-referrals-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referrals you set can be automatically overwritten by the server to reference replicas.

PROPERTY: repl-role

Syntax	not-replicated | master | hub | consumer
Default Value	not-replicated
Is readable	Yes
Is modifiable	Yes, using the subcommands to manage replication
Is multi-valued	No

This property specifies the role played by the suffix in a replicated topology.

not-replicated

The suffix is not part of a replicated toplogy.

master

This suffix is a supplier of replication updates in a replicated topology. It can accept both read and write operations.

hub

This suffix is a supplier of replication updates in a replicated topology. It can accept read operations and replication updates.

consumer

This suffix is a dedicated consumer of replication updates in a replicated topology. It can accept read operations and replication updates, but not writes from clients.

To promote a replica, use the dsconf promote-repl command. To demote a replica, use the dsconf demote-repl command.

PROPERTY: require-index-enabled

Syntax	on|off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether unindexed searches are allowed. When on, unindexed searches return LDAP_UNWILLING_TO_PERFORM.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), enabled(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

repl-rewrite-referrals-enabled(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

suffix, db-name, entry-cache-count, entry-cache-size, entry-count, index-filter-analyzer-enabled, index-filter-analyzer-max-entries, parent-suffix-dn, referral-mode, repl-accept-client-update-enabled, repl-cl-max-age, repl-cl-max-entry-count, repl-id, repl-manager-bind-dn, repl-purge-delay, repl-rewrite-referrals-enabled, repl-role, require-index-enabled – DS suffix configuration (SUF) properties

Description

Each Directory Server suffix you create is configured according to the suffix properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: db-name

Syntax	STRING
Default Value	suffixName
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the suffix that is used to process requests involving the database.

PROPERTY: db-path

Syntax	PATH
Default Value	server-instance-dir/db/suffix-dir
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the absolute path to the suffix database.

PROPERTY: entry-cache-count

Syntax	INTEGER | unlimited
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of entries allowed in the entry cache of the suffix.

PROPERTY: entry-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum amount of memory Directory Server requests for the entry cache of the suffix.

PROPERTY: entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the number of entries stored in the suffix.

PROPERTY: index-filter-analyzer-enabled

Syntax	off and on
Default Value	off
Is readable	Yes
Is modifiable	No
Is multi-valued	No
Restart needed	No

This property specifies whether the index filter analyzer is running.

PROPERTY: index-filter-analyzer-max-entries

Syntax	Integer
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No
Restart needed	No

This property specifies the maximum number of entries that the index filter analyzer may contain.

PROPERTY: parent-suffix-dn

Syntax	DN | undefined
Default Value	DN of the parent entry
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the DN of the parent entry for the suffix. The value of this property must logically be a parent of the suffix.

For instance, if you have a suffix with DN dc=com and a suffix dc=example,dc=com, you can set dc=com as the parent-suffix-dn of dc=example,dc=com, and subtree searches with based DN dc=com then also travers dc=example,dc=com.

PROPERTY: referral-mode

Syntax	disabled | enabled | only-on-write
Default Value	disabled
Is readable	Yes
Is modifiable	Yes, if the suffix is not replicated
Is multi-valued	No

This property specifies how referrals are used when a client makes a request involving the suffix.

disabled

Handle requests locally; do not return referral URLs.

enabled

Return referral URLs to client requests.

only-on-write

Return referral URLs to client requests only for write operations.

PROPERTY: repl-accept-client-update-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the replicated suffix accepts write operations from client applications, or instead returns referral URLs.

PROPERTY: repl-cl-max-age

Syntax	DURATION | undefined
Default Value	7d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age for a record in the replication changelog. Older records are purged.

PROPERTY: repl-cl-max-entry-count

Syntax	INTEGER
Default Value	0 (meaning undefined)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the replication changelog. When the limit is exceeded, older records are purged.

PROPERTY: repl-id

Syntax	INTEGER
Default Value	None
Is readable	Yes
Is modifiable	Yes, using the subcommands to manage replication
Is multi-valued	No

This property specifies the replica identification number, 1-65534 for a supplier, 65535 for a consumer or a hub. Once set, this property cannot be modified.

PROPERTY: repl-manager-bind-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the bind DNs of users allowed to bind to perform replication operations on the suffix.

PROPERTY: repl-purge-delay

Syntax	DURATION | never
Default Value	7d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of tombstone entries used by replication. Tombstone entries are entries marked for deletion that have not yet been removed, and also replication state information associated with the entries. When setting this attribute, ensure that the purge delay is longer than the longest replication cycle in your replication policy to avoid incurring conflict resolution problems and divergence between replicas.

PROPERTY: repl-rewrite-referrals-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referrals you set can be automatically overwritten by the server to reference replicas.

PROPERTY: repl-role

Syntax	not-replicated | master | hub | consumer
Default Value	not-replicated
Is readable	Yes
Is modifiable	Yes, using the subcommands to manage replication
Is multi-valued	No

This property specifies the role played by the suffix in a replicated topology.

not-replicated

The suffix is not part of a replicated toplogy.

master

This suffix is a supplier of replication updates in a replicated topology. It can accept both read and write operations.

hub

This suffix is a supplier of replication updates in a replicated topology. It can accept read operations and replication updates.

consumer

This suffix is a dedicated consumer of replication updates in a replicated topology. It can accept read operations and replication updates, but not writes from clients.

To promote a replica, use the dsconf promote-repl command. To demote a replica, use the dsconf demote-repl command.

PROPERTY: require-index-enabled

Syntax	on|off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether unindexed searches are allowed. When on, unindexed searches return LDAP_UNWILLING_TO_PERFORM.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), enabled(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

repl-role(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

suffix, db-name, entry-cache-count, entry-cache-size, entry-count, index-filter-analyzer-enabled, index-filter-analyzer-max-entries, parent-suffix-dn, referral-mode, repl-accept-client-update-enabled, repl-cl-max-age, repl-cl-max-entry-count, repl-id, repl-manager-bind-dn, repl-purge-delay, repl-rewrite-referrals-enabled, repl-role, require-index-enabled – DS suffix configuration (SUF) properties

Description

Each Directory Server suffix you create is configured according to the suffix properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: db-name

Syntax	STRING
Default Value	suffixName
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the suffix that is used to process requests involving the database.

PROPERTY: db-path

Syntax	PATH
Default Value	server-instance-dir/db/suffix-dir
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the absolute path to the suffix database.

PROPERTY: entry-cache-count

Syntax	INTEGER | unlimited
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of entries allowed in the entry cache of the suffix.

PROPERTY: entry-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum amount of memory Directory Server requests for the entry cache of the suffix.

PROPERTY: entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the number of entries stored in the suffix.

PROPERTY: index-filter-analyzer-enabled

Syntax	off and on
Default Value	off
Is readable	Yes
Is modifiable	No
Is multi-valued	No
Restart needed	No

This property specifies whether the index filter analyzer is running.

PROPERTY: index-filter-analyzer-max-entries

Syntax	Integer
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No
Restart needed	No

This property specifies the maximum number of entries that the index filter analyzer may contain.

PROPERTY: parent-suffix-dn

Syntax	DN | undefined
Default Value	DN of the parent entry
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the DN of the parent entry for the suffix. The value of this property must logically be a parent of the suffix.

For instance, if you have a suffix with DN dc=com and a suffix dc=example,dc=com, you can set dc=com as the parent-suffix-dn of dc=example,dc=com, and subtree searches with based DN dc=com then also travers dc=example,dc=com.

PROPERTY: referral-mode

Syntax	disabled | enabled | only-on-write
Default Value	disabled
Is readable	Yes
Is modifiable	Yes, if the suffix is not replicated
Is multi-valued	No

This property specifies how referrals are used when a client makes a request involving the suffix.

disabled

Handle requests locally; do not return referral URLs.

enabled

Return referral URLs to client requests.

only-on-write

Return referral URLs to client requests only for write operations.

PROPERTY: repl-accept-client-update-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the replicated suffix accepts write operations from client applications, or instead returns referral URLs.

PROPERTY: repl-cl-max-age

Syntax	DURATION | undefined
Default Value	7d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age for a record in the replication changelog. Older records are purged.

PROPERTY: repl-cl-max-entry-count

Syntax	INTEGER
Default Value	0 (meaning undefined)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the replication changelog. When the limit is exceeded, older records are purged.

PROPERTY: repl-id

Syntax	INTEGER
Default Value	None
Is readable	Yes
Is modifiable	Yes, using the subcommands to manage replication
Is multi-valued	No

This property specifies the replica identification number, 1-65534 for a supplier, 65535 for a consumer or a hub. Once set, this property cannot be modified.

PROPERTY: repl-manager-bind-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the bind DNs of users allowed to bind to perform replication operations on the suffix.

PROPERTY: repl-purge-delay

Syntax	DURATION | never
Default Value	7d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of tombstone entries used by replication. Tombstone entries are entries marked for deletion that have not yet been removed, and also replication state information associated with the entries. When setting this attribute, ensure that the purge delay is longer than the longest replication cycle in your replication policy to avoid incurring conflict resolution problems and divergence between replicas.

PROPERTY: repl-rewrite-referrals-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referrals you set can be automatically overwritten by the server to reference replicas.

PROPERTY: repl-role

Syntax	not-replicated | master | hub | consumer
Default Value	not-replicated
Is readable	Yes
Is modifiable	Yes, using the subcommands to manage replication
Is multi-valued	No

This property specifies the role played by the suffix in a replicated topology.

not-replicated

The suffix is not part of a replicated toplogy.

master

This suffix is a supplier of replication updates in a replicated topology. It can accept both read and write operations.

hub

This suffix is a supplier of replication updates in a replicated topology. It can accept read operations and replication updates.

consumer

This suffix is a dedicated consumer of replication updates in a replicated topology. It can accept read operations and replication updates, but not writes from clients.

To promote a replica, use the dsconf promote-repl command. To demote a replica, use the dsconf demote-repl command.

PROPERTY: require-index-enabled

Syntax	on|off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether unindexed searches are allowed. When on, unindexed searches return LDAP_UNWILLING_TO_PERFORM.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), enabled(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

repl-schedule(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

repl-agmt, auth-bind-dn, auth-protocol, auth-pwd, repl-fractional-exclude-attr, repl-fractional-include-attr, repl-schedule, transport-compression, transport-group-size, transport-window-size – DS replication agreement configuration (RAG) properties

Description

A replication agreement governs how a Directory Server supplier updates a Directory Server consumer. Although this configuration element is called an agreement, it concerns the configuration only of the supplier.

PROPERTY: auth-bind-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the bind DN used by the supplier to bind to the consumer in order to perform replication-related updates. This bind DN must be present on the consumer.

PROPERTY: auth-protocol

Syntax	clear|ssl-simple|ssl-client
Default Value	clear
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the protocol used by the supplier to bind to the consumer in order to perform replication-related updates. The default is to bind with simple authentication in clear text without securing the connection, as most replications connections are made on an internal network. You may however configure replication to use SSL and simple authentication to protect the connection from malicious snooping, or SSL with client authentication to further protect the connection.

PROPERTY: auth-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password used by the supplier to bind to the consumer. You provide it using auth-pwd-file.

PROPERTY: auth-pwd-file

Syntax	PATH
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the bind password for replication is read to create the replication agreement. The file is read once on replication agreement creation, and the password is stored for future use.

PROPERTY: repl-fractional-exclude-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the list of attributes not to replicate. This property is mutually exclusive with repl-fractional-include-attr.

PROPERTY: repl-fractional-include-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the list of attributes to replicate. This property is mutually exclusive with repl-fractional-exclude-attr.

PROPERTY: repl-schedule

Syntax	INTERVAL | always
Default Value	always
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the times and days when replication can take place.

PROPERTY: transport-compression

Syntax	best-compression | best-speed | default-compression | no-compression
Default Value	no-compression
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the level of libz(3) compression used on replication updates from the supplier to the consumer. Supported settings are as follows.

no-compression

No compression

default-compression

Default zlib compression (zlib numeric value = -1)

best-speed

Fastest zlib compression (zlib numeric value = 1)

best-compression

Strongest zlib compression (zlib numeric value = 9)

If the bottleneck for replication in your environment is network bandwidth, this property can potentially help you tune the replication protocol for better performance.

PROPERTY: transport-group-size

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many replication messages are grouped on the supplier before being sent to the consumer. Valid range is 1 to 255.

If the bottleneck for replication in your environment is network bandwidth, this property can potentially help you tune the replication protocol for better performance.

PROPERTY: transport-window-size

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of replication messages sent from the supplier to the consumer before waiting for a response from the consumer to continue. Valid range is 1 to 65535.

If the bottleneck for replication in your environment is network latency or network bandwidth, this property can potentially help you tune the replication protocol for better performance.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), desc(5dsconf), enabled(5dsconf)

ODSEE 11.1.1.3.0  Last Revised June 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

repl-user-schema-enabled(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

require-bind-pwd-enabled(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

require-index-enabled(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

suffix, db-name, entry-cache-count, entry-cache-size, entry-count, index-filter-analyzer-enabled, index-filter-analyzer-max-entries, parent-suffix-dn, referral-mode, repl-accept-client-update-enabled, repl-cl-max-age, repl-cl-max-entry-count, repl-id, repl-manager-bind-dn, repl-purge-delay, repl-rewrite-referrals-enabled, repl-role, require-index-enabled – DS suffix configuration (SUF) properties

Description

Each Directory Server suffix you create is configured according to the suffix properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: db-name

Syntax	STRING
Default Value	suffixName
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the suffix that is used to process requests involving the database.

PROPERTY: db-path

Syntax	PATH
Default Value	server-instance-dir/db/suffix-dir
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the absolute path to the suffix database.

PROPERTY: entry-cache-count

Syntax	INTEGER | unlimited
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of entries allowed in the entry cache of the suffix.

PROPERTY: entry-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum amount of memory Directory Server requests for the entry cache of the suffix.

PROPERTY: entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the number of entries stored in the suffix.

PROPERTY: index-filter-analyzer-enabled

Syntax	off and on
Default Value	off
Is readable	Yes
Is modifiable	No
Is multi-valued	No
Restart needed	No

This property specifies whether the index filter analyzer is running.

PROPERTY: index-filter-analyzer-max-entries

Syntax	Integer
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No
Restart needed	No

This property specifies the maximum number of entries that the index filter analyzer may contain.

PROPERTY: parent-suffix-dn

Syntax	DN | undefined
Default Value	DN of the parent entry
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the DN of the parent entry for the suffix. The value of this property must logically be a parent of the suffix.

For instance, if you have a suffix with DN dc=com and a suffix dc=example,dc=com, you can set dc=com as the parent-suffix-dn of dc=example,dc=com, and subtree searches with based DN dc=com then also travers dc=example,dc=com.

PROPERTY: referral-mode

Syntax	disabled | enabled | only-on-write
Default Value	disabled
Is readable	Yes
Is modifiable	Yes, if the suffix is not replicated
Is multi-valued	No

This property specifies how referrals are used when a client makes a request involving the suffix.

disabled

Handle requests locally; do not return referral URLs.

enabled

Return referral URLs to client requests.

only-on-write

Return referral URLs to client requests only for write operations.

PROPERTY: repl-accept-client-update-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the replicated suffix accepts write operations from client applications, or instead returns referral URLs.

PROPERTY: repl-cl-max-age

Syntax	DURATION | undefined
Default Value	7d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age for a record in the replication changelog. Older records are purged.

PROPERTY: repl-cl-max-entry-count

Syntax	INTEGER
Default Value	0 (meaning undefined)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the replication changelog. When the limit is exceeded, older records are purged.

PROPERTY: repl-id

Syntax	INTEGER
Default Value	None
Is readable	Yes
Is modifiable	Yes, using the subcommands to manage replication
Is multi-valued	No

This property specifies the replica identification number, 1-65534 for a supplier, 65535 for a consumer or a hub. Once set, this property cannot be modified.

PROPERTY: repl-manager-bind-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the bind DNs of users allowed to bind to perform replication operations on the suffix.

PROPERTY: repl-purge-delay

Syntax	DURATION | never
Default Value	7d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of tombstone entries used by replication. Tombstone entries are entries marked for deletion that have not yet been removed, and also replication state information associated with the entries. When setting this attribute, ensure that the purge delay is longer than the longest replication cycle in your replication policy to avoid incurring conflict resolution problems and divergence between replicas.

PROPERTY: repl-rewrite-referrals-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referrals you set can be automatically overwritten by the server to reference replicas.

PROPERTY: repl-role

Syntax	not-replicated | master | hub | consumer
Default Value	not-replicated
Is readable	Yes
Is modifiable	Yes, using the subcommands to manage replication
Is multi-valued	No

This property specifies the role played by the suffix in a replicated topology.

not-replicated

The suffix is not part of a replicated toplogy.

master

This suffix is a supplier of replication updates in a replicated topology. It can accept both read and write operations.

hub

This suffix is a supplier of replication updates in a replicated topology. It can accept read operations and replication updates.

consumer

This suffix is a dedicated consumer of replication updates in a replicated topology. It can accept read operations and replication updates, but not writes from clients.

To promote a replica, use the dsconf promote-repl command. To demote a replica, use the dsconf demote-repl command.

PROPERTY: require-index-enabled

Syntax	on|off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether unindexed searches are allowed. When on, unindexed searches return LDAP_UNWILLING_TO_PERFORM.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), enabled(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

retro-cl-deleted-entry-attr(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

retro-cl-enabled(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

retro-cl-ignored-attr(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

retro-cl-max-age(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

retro-cl-max-entry-count(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

retro-cl-path(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

retro-cl-suffix-dn(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

root-dn(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

root-pwd(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

root-pwd-file(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

root-pwd-storage-scheme(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

rotation-interval(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

log, buffering-enabled, level, max-age, max-disk-space-size, max-file-count, max-size, min-free-disk-space-size, path, perm, rotation-interval, rotation-min-file-size, rotation-time, verbose-enabled – DS logging configuration (LOG) properties

Description

Directory Server writes to three main types of log files you can configure, the INSTANCE_PATH/logs/access, INSTANCE_PATH/logs/audit, and INSTANCE_PATH/logs/errors logs, where INSTANCE_PATH is the full path where the server instance is located, such as /local/dsInst.

When you specify one of these properties with dsconf get-log-prop or dsconf set-log-prop, you must specify which type of log configuration, access, audit, or error, you want to examine. For example, to see whether audit logging is enabled for a server instance:

$ dsconf get-log-prop audit enabled enabled : off $

PROPERTY: buffering-enabled

Syntax	on | off
Default Value	on for access, not applicable to audit and errors logs
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property indicates whether Directory Server writes access log entries directly to disk, or use a buffer, by default.

PROPERTY: enabled

Syntax	on | off
Default Value	on for access, off for audit, on for errors
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property indicates whether the specified log type is enabled.

PROPERTY: level

Syntax	See the description that follows.
Default Value	default
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property defines which kinds of messages get logged. This property is applicable only to access and errors logs.

access log levels

The following settings are supported:

acc-internal

Log access information for internal operations.

default

Log client access to entries.

acc-default_plus_referrals

As default, but also log access to referrals.

acc-timing

Use precise timing for microsecond resolution of elapsed times.

errors log levels

The following settings are supported:

default

Log startup, shutdown, errors, and warnings.

err-function-calls

Log when server enters or exits a function.

err-search-args

Log search arguments.

err-connection

Connection management.

err-packets

Log packets sent and received.

err-search-filter

Log search filter information.

err-config-file

Log information for changes to the configuration file dse.ldif.

err-acl

Log access control processing information.

err-ldbm

Log information from the ldbm database plugin.

err-entry-parsing

Log LDIF parsing errors.

err-housekeeping

Log event queue information.

err-replication

Log information about replication operations.

err-entry-cache

Log entry cache information.

err-plugins

Log information from server plug-ins.

err-dsml

Log information from DSML front end.

err-dsml-advanced

Debugging information for DSML.

PROPERTY: max-age

Syntax	DURATION | unlimited
Default Value	1M (one month)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the age beyond which the specified type of log file is deleted.

PROPERTY: max-disk-space-size

Syntax	MEMORY_SIZE | unlimited
Default Value	500M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the maximum disk space the specified type of log is allowed to consume. When the limit is reached, the server deletes the oldest log file to reclaim disk space.

PROPERTY: max-file-count

Syntax	Integer
Default Value	10 for access, 2 for errors, 1 for audit
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the maximum number of log files, including rotated logs, of the specified type that the server allows to be created in the log file directory. When the limit is reached, the server deletes the oldest log file to reclaim disk space.

When you set this property to 1, the specified log is not rotated.

PROPERTY: max-size

Syntax	MEMORY_SIZE | unlimited
Default Value	100M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the maximum file size for the specified log. When the limit is reached, the server rotates the log file, unless max-file-count is set to 1.

PROPERTY: min-free-disk-space-size

Syntax	MEMORY_SIZE
Default Value	5M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the minimum free space allowed on the disk where the specified log is stored. When the limit is reached, the server deletes the oldest log files until enough space is available.

PROPERTY: path

Syntax	PATH
Default Value	INSTANCE_PATH/logs/access, INSTANCE_PATH/logs/audit, INSTANCE_PATH/logs/errors
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the full path to the specified log file type.

PROPERTY: perm

Syntax	OCTAL_MODE
Default Value	600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the read, write, and execute permissions on the specified log file.

PROPERTY: rotation-interval

Syntax	DURATION | unlimited
Default Value	1d (one day) for access, 1w (one week) for audit and errors
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the duration between rotations of the specified log file.

PROPERTY: rotation-min-file-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the minimum size the specified log file must have before the server rotates it.

PROPERTY: rotation-time

Syntax	TIME | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the time of day when the server rotates the specified log file.

PROPERTY: verbose-enabled

Syntax	on|off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether extra informational messages are written to the errors log.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), enabled(5dsconf)

ODSEE 11.1.1.3.0  Last Revised April 12, 2007

Name | Description | SYNTAX VALUES | Attributes | See Also

rotation-min-file-size(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

log, buffering-enabled, level, max-age, max-disk-space-size, max-file-count, max-size, min-free-disk-space-size, path, perm, rotation-interval, rotation-min-file-size, rotation-time, verbose-enabled – DS logging configuration (LOG) properties

Description

Directory Server writes to three main types of log files you can configure, the INSTANCE_PATH/logs/access, INSTANCE_PATH/logs/audit, and INSTANCE_PATH/logs/errors logs, where INSTANCE_PATH is the full path where the server instance is located, such as /local/dsInst.

When you specify one of these properties with dsconf get-log-prop or dsconf set-log-prop, you must specify which type of log configuration, access, audit, or error, you want to examine. For example, to see whether audit logging is enabled for a server instance:

$ dsconf get-log-prop audit enabled enabled : off $

PROPERTY: buffering-enabled

Syntax	on | off
Default Value	on for access, not applicable to audit and errors logs
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property indicates whether Directory Server writes access log entries directly to disk, or use a buffer, by default.

PROPERTY: enabled

Syntax	on | off
Default Value	on for access, off for audit, on for errors
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property indicates whether the specified log type is enabled.

PROPERTY: level

Syntax	See the description that follows.
Default Value	default
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property defines which kinds of messages get logged. This property is applicable only to access and errors logs.

access log levels

The following settings are supported:

acc-internal

Log access information for internal operations.

default

Log client access to entries.

acc-default_plus_referrals

As default, but also log access to referrals.

acc-timing

Use precise timing for microsecond resolution of elapsed times.

errors log levels

The following settings are supported:

default

Log startup, shutdown, errors, and warnings.

err-function-calls

Log when server enters or exits a function.

err-search-args

Log search arguments.

err-connection

Connection management.

err-packets

Log packets sent and received.

err-search-filter

Log search filter information.

err-config-file

Log information for changes to the configuration file dse.ldif.

err-acl

Log access control processing information.

err-ldbm

Log information from the ldbm database plugin.

err-entry-parsing

Log LDIF parsing errors.

err-housekeeping

Log event queue information.

err-replication

Log information about replication operations.

err-entry-cache

Log entry cache information.

err-plugins

Log information from server plug-ins.

err-dsml

Log information from DSML front end.

err-dsml-advanced

Debugging information for DSML.

PROPERTY: max-age

Syntax	DURATION | unlimited
Default Value	1M (one month)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the age beyond which the specified type of log file is deleted.

PROPERTY: max-disk-space-size

Syntax	MEMORY_SIZE | unlimited
Default Value	500M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the maximum disk space the specified type of log is allowed to consume. When the limit is reached, the server deletes the oldest log file to reclaim disk space.

PROPERTY: max-file-count

Syntax	Integer
Default Value	10 for access, 2 for errors, 1 for audit
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the maximum number of log files, including rotated logs, of the specified type that the server allows to be created in the log file directory. When the limit is reached, the server deletes the oldest log file to reclaim disk space.

When you set this property to 1, the specified log is not rotated.

PROPERTY: max-size

Syntax	MEMORY_SIZE | unlimited
Default Value	100M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the maximum file size for the specified log. When the limit is reached, the server rotates the log file, unless max-file-count is set to 1.

PROPERTY: min-free-disk-space-size

Syntax	MEMORY_SIZE
Default Value	5M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the minimum free space allowed on the disk where the specified log is stored. When the limit is reached, the server deletes the oldest log files until enough space is available.

PROPERTY: path

Syntax	PATH
Default Value	INSTANCE_PATH/logs/access, INSTANCE_PATH/logs/audit, INSTANCE_PATH/logs/errors
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the full path to the specified log file type.

PROPERTY: perm

Syntax	OCTAL_MODE
Default Value	600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the read, write, and execute permissions on the specified log file.

PROPERTY: rotation-interval

Syntax	DURATION | unlimited
Default Value	1d (one day) for access, 1w (one week) for audit and errors
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the duration between rotations of the specified log file.

PROPERTY: rotation-min-file-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the minimum size the specified log file must have before the server rotates it.

PROPERTY: rotation-time

Syntax	TIME | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the time of day when the server rotates the specified log file.

PROPERTY: verbose-enabled

Syntax	on|off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether extra informational messages are written to the errors log.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), enabled(5dsconf)

ODSEE 11.1.1.3.0  Last Revised April 12, 2007

Name | Description | SYNTAX VALUES | Attributes | See Also

rotation-time(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

log, buffering-enabled, level, max-age, max-disk-space-size, max-file-count, max-size, min-free-disk-space-size, path, perm, rotation-interval, rotation-min-file-size, rotation-time, verbose-enabled – DS logging configuration (LOG) properties

Description

Directory Server writes to three main types of log files you can configure, the INSTANCE_PATH/logs/access, INSTANCE_PATH/logs/audit, and INSTANCE_PATH/logs/errors logs, where INSTANCE_PATH is the full path where the server instance is located, such as /local/dsInst.

When you specify one of these properties with dsconf get-log-prop or dsconf set-log-prop, you must specify which type of log configuration, access, audit, or error, you want to examine. For example, to see whether audit logging is enabled for a server instance:

$ dsconf get-log-prop audit enabled enabled : off $

PROPERTY: buffering-enabled

Syntax	on | off
Default Value	on for access, not applicable to audit and errors logs
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property indicates whether Directory Server writes access log entries directly to disk, or use a buffer, by default.

PROPERTY: enabled

Syntax	on | off
Default Value	on for access, off for audit, on for errors
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property indicates whether the specified log type is enabled.

PROPERTY: level

Syntax	See the description that follows.
Default Value	default
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property defines which kinds of messages get logged. This property is applicable only to access and errors logs.

access log levels

The following settings are supported:

acc-internal

Log access information for internal operations.

default

Log client access to entries.

acc-default_plus_referrals

As default, but also log access to referrals.

acc-timing

Use precise timing for microsecond resolution of elapsed times.

errors log levels

The following settings are supported:

default

Log startup, shutdown, errors, and warnings.

err-function-calls

Log when server enters or exits a function.

err-search-args

Log search arguments.

err-connection

Connection management.

err-packets

Log packets sent and received.

err-search-filter

Log search filter information.

err-config-file

Log information for changes to the configuration file dse.ldif.

err-acl

Log access control processing information.

err-ldbm

Log information from the ldbm database plugin.

err-entry-parsing

Log LDIF parsing errors.

err-housekeeping

Log event queue information.

err-replication

Log information about replication operations.

err-entry-cache

Log entry cache information.

err-plugins

Log information from server plug-ins.

err-dsml

Log information from DSML front end.

err-dsml-advanced

Debugging information for DSML.

PROPERTY: max-age

Syntax	DURATION | unlimited
Default Value	1M (one month)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the age beyond which the specified type of log file is deleted.

PROPERTY: max-disk-space-size

Syntax	MEMORY_SIZE | unlimited
Default Value	500M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the maximum disk space the specified type of log is allowed to consume. When the limit is reached, the server deletes the oldest log file to reclaim disk space.

PROPERTY: max-file-count

Syntax	Integer
Default Value	10 for access, 2 for errors, 1 for audit
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the maximum number of log files, including rotated logs, of the specified type that the server allows to be created in the log file directory. When the limit is reached, the server deletes the oldest log file to reclaim disk space.

When you set this property to 1, the specified log is not rotated.

PROPERTY: max-size

Syntax	MEMORY_SIZE | unlimited
Default Value	100M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the maximum file size for the specified log. When the limit is reached, the server rotates the log file, unless max-file-count is set to 1.

PROPERTY: min-free-disk-space-size

Syntax	MEMORY_SIZE
Default Value	5M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the minimum free space allowed on the disk where the specified log is stored. When the limit is reached, the server deletes the oldest log files until enough space is available.

PROPERTY: path

Syntax	PATH
Default Value	INSTANCE_PATH/logs/access, INSTANCE_PATH/logs/audit, INSTANCE_PATH/logs/errors
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the full path to the specified log file type.

PROPERTY: perm

Syntax	OCTAL_MODE
Default Value	600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the read, write, and execute permissions on the specified log file.

PROPERTY: rotation-interval

Syntax	DURATION | unlimited
Default Value	1d (one day) for access, 1w (one week) for audit and errors
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the duration between rotations of the specified log file.

PROPERTY: rotation-min-file-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the minimum size the specified log file must have before the server rotates it.

PROPERTY: rotation-time

Syntax	TIME | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the time of day when the server rotates the specified log file.

PROPERTY: verbose-enabled

Syntax	on|off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether extra informational messages are written to the errors log.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), enabled(5dsconf)

ODSEE 11.1.1.3.0  Last Revised April 12, 2007

Name | Description | SYNTAX VALUES | Attributes | See Also

search-size-limit(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

search-time-limit(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

secure-listen-address(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

server(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

ssl-cipher-family(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

ssl-client-auth-mode(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

ssl-enabled(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

ssl-rsa-cert-name(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

ssl-rsa-security-device(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

ssl-supported-ciphers(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

sub-enabled(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

index, all-ids-threshold-eq, all-ids-threshold-pres, all-ids-threshold-sub, approx-enabled, eq-enabled, matching-rule, pres-enabled, sub-enabled, system – DS attribute indexing (IDX) properties

Description

Directory Server can index attributes, making them faster to search. The dsconf command helps you configure five of the six supported index types:

1. Equality indexes to determine expediently whether an attribute value is equal to a specified value

2. Presence indexes to determine whether a specified attribute has any values

3. Substring indexes to determine whether a specified attribute has values containing a specified string, also used to compare regular expressions to attribute values

4. Approximate indexes, based on metaphone approximation and useful for English language strings only, to determine whether a specified attribute has any values that sound like the specified string

5. International indexes, also called matching rule indexes, to expedite sorting and searching in accordance with the language rules of a particular locale

The dsconf command does not help you configure virtual list view, also known as browsing, indexes.

The dsconf command does help you assign all IDs threshold values to indexes. As the number of entries and attribute values grows in a directory, the number of attribute values to index also grows, as does therefore the size of the indexes. In some deployments a server can end up maintaining index lists so large that the cost of rebuilding an index when attributes are modified or added outweighs the benefit the index provides for searches. All IDs thresholds limit the growth of large indexes by definining the maximum number of entry identifiers Directory Server maintains in an index list. You can define all IDs thresholds for individual indexes and for some types of indexes.

Some indexes are maintained by the server for its own use. These are called system indexes. In general, do not modify or remove systems indexes; such modifications could have severe repercussions on performance.

See Directory Server Indexing in Oracle Fusion Middleware Reference for Oracle Directory Server Enterprise Edition for further details about indexing.

PROPERTY: all-ids-threshold

Syntax	INTEGER | inherited
Default Value	inherited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the maximum number of entry IDs the server maintains in an index list for the specified attribute type. By default its value is inherited from the all-ids-threshold setting for the suffix, whose default value in turn is inherited from the all-ids-threshold setting for the server, which by default is 4000. In addition to inheritance of default settings, this property handles settings as follows:

inherited

The threshold is inherited from the more global setting.

<2000

The threshold value is rounded up to 2000.

>2000

The setting is used as a guaranteed minimum threshold. Because of internal mechanisms, the real value can be slightly more than the specified value.

After you modify this property, reindex the attribute for which you changed the threshold. For example:

$ dsconf set-index-prop dc=example,dc=com uid all-ids-threshold:5000 $ dsconf reindex -t uid dc=example,dc=com ## example: Indexing attribute: uid ## example: Finished indexing. Task completed (slapd exit code: 0). $

PROPERTY: all-ids-threshold-eq

Syntax	INTEGER | inherited
Default Value	inherited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the all IDs threshold for equality indexes of the specified attribute. By default its value is inherited from the all-ids-threshold setting for the attribute type. See all-ids-threshold(5dsconf) for more information.

PROPERTY: all-ids-threshold-pres

Syntax	INTEGER | inherited
Default Value	inherited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the all IDs threshold for presence indexes of the specified attribute. By default its value is inherited from the all-ids-threshold setting for the attribute type. See all-ids-threshold(5dsconf) for more information.

PROPERTY: all-ids-threshold-sub

Syntax	INTEGER | inherited
Default Value	inherited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the all IDs threshold for substring indexes of the specified attribute. By default its value is inherited from the all-ids-threshold setting for the attribute type. See all-ids-threshold(5dsconf) for more information.

PROPERTY: approx-enabled

Syntax	on|off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether approximate indexes are maintained for the specified attribute type. You cannot set an all IDs threshold value for approximate indexes.

PROPERTY: desc

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

Use this optional property to provide a short description of the index configuration.

PROPERTY: eq-enabled

Syntax	on|off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether equality indexes are maintained for the specified attribute type.

PROPERTY: matching-rule

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the matching rule indexes maintained for the specified attribute type.

Values for this property must be valid collation order object identifiers (OIDs). See Directory Server Internationalized Directory in Directory Server Enterprise Edition Reference for the OIDs corresponding to supported locales.

PROPERTY: pres-enabled

Syntax	on|off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether presence indexes are maintained for the specified attribute type.

PROPERTY: sub-enabled

Syntax	on|off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether substring indexes are maintained for the specified attribute type.

PROPERTY: system

Syntax	true|false
Default Value	false
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property identifies whether the specified index is a system index, and therefore should be left alone.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), desc(5dsconf)

ODSEE 11.1.1.3.0  Last Revised June 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

suffix(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

suffix, db-name, entry-cache-count, entry-cache-size, entry-count, index-filter-analyzer-enabled, index-filter-analyzer-max-entries, parent-suffix-dn, referral-mode, repl-accept-client-update-enabled, repl-cl-max-age, repl-cl-max-entry-count, repl-id, repl-manager-bind-dn, repl-purge-delay, repl-rewrite-referrals-enabled, repl-role, require-index-enabled – DS suffix configuration (SUF) properties

Description

Each Directory Server suffix you create is configured according to the suffix properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: db-name

Syntax	STRING
Default Value	suffixName
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the suffix that is used to process requests involving the database.

PROPERTY: db-path

Syntax	PATH
Default Value	server-instance-dir/db/suffix-dir
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the absolute path to the suffix database.

PROPERTY: entry-cache-count

Syntax	INTEGER | unlimited
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of entries allowed in the entry cache of the suffix.

PROPERTY: entry-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum amount of memory Directory Server requests for the entry cache of the suffix.

PROPERTY: entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the number of entries stored in the suffix.

PROPERTY: index-filter-analyzer-enabled

Syntax	off and on
Default Value	off
Is readable	Yes
Is modifiable	No
Is multi-valued	No
Restart needed	No

This property specifies whether the index filter analyzer is running.

PROPERTY: index-filter-analyzer-max-entries

Syntax	Integer
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No
Restart needed	No

This property specifies the maximum number of entries that the index filter analyzer may contain.

PROPERTY: parent-suffix-dn

Syntax	DN | undefined
Default Value	DN of the parent entry
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the DN of the parent entry for the suffix. The value of this property must logically be a parent of the suffix.

For instance, if you have a suffix with DN dc=com and a suffix dc=example,dc=com, you can set dc=com as the parent-suffix-dn of dc=example,dc=com, and subtree searches with based DN dc=com then also travers dc=example,dc=com.

PROPERTY: referral-mode

Syntax	disabled | enabled | only-on-write
Default Value	disabled
Is readable	Yes
Is modifiable	Yes, if the suffix is not replicated
Is multi-valued	No

This property specifies how referrals are used when a client makes a request involving the suffix.

disabled

Handle requests locally; do not return referral URLs.

enabled

Return referral URLs to client requests.

only-on-write

Return referral URLs to client requests only for write operations.

PROPERTY: repl-accept-client-update-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the replicated suffix accepts write operations from client applications, or instead returns referral URLs.

PROPERTY: repl-cl-max-age

Syntax	DURATION | undefined
Default Value	7d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age for a record in the replication changelog. Older records are purged.

PROPERTY: repl-cl-max-entry-count

Syntax	INTEGER
Default Value	0 (meaning undefined)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the replication changelog. When the limit is exceeded, older records are purged.

PROPERTY: repl-id

Syntax	INTEGER
Default Value	None
Is readable	Yes
Is modifiable	Yes, using the subcommands to manage replication
Is multi-valued	No

This property specifies the replica identification number, 1-65534 for a supplier, 65535 for a consumer or a hub. Once set, this property cannot be modified.

PROPERTY: repl-manager-bind-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the bind DNs of users allowed to bind to perform replication operations on the suffix.

PROPERTY: repl-purge-delay

Syntax	DURATION | never
Default Value	7d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of tombstone entries used by replication. Tombstone entries are entries marked for deletion that have not yet been removed, and also replication state information associated with the entries. When setting this attribute, ensure that the purge delay is longer than the longest replication cycle in your replication policy to avoid incurring conflict resolution problems and divergence between replicas.

PROPERTY: repl-rewrite-referrals-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referrals you set can be automatically overwritten by the server to reference replicas.

PROPERTY: repl-role

Syntax	not-replicated | master | hub | consumer
Default Value	not-replicated
Is readable	Yes
Is modifiable	Yes, using the subcommands to manage replication
Is multi-valued	No

This property specifies the role played by the suffix in a replicated topology.

not-replicated

The suffix is not part of a replicated toplogy.

master

This suffix is a supplier of replication updates in a replicated topology. It can accept both read and write operations.

hub

This suffix is a supplier of replication updates in a replicated topology. It can accept read operations and replication updates.

consumer

This suffix is a dedicated consumer of replication updates in a replicated topology. It can accept read operations and replication updates, but not writes from clients.

To promote a replica, use the dsconf promote-repl command. To demote a replica, use the dsconf demote-repl command.

PROPERTY: require-index-enabled

Syntax	on|off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether unindexed searches are allowed. When on, unindexed searches return LDAP_UNWILLING_TO_PERFORM.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), enabled(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

system(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

index, all-ids-threshold-eq, all-ids-threshold-pres, all-ids-threshold-sub, approx-enabled, eq-enabled, matching-rule, pres-enabled, sub-enabled, system – DS attribute indexing (IDX) properties

Description

Directory Server can index attributes, making them faster to search. The dsconf command helps you configure five of the six supported index types:

1. Equality indexes to determine expediently whether an attribute value is equal to a specified value

2. Presence indexes to determine whether a specified attribute has any values

3. Substring indexes to determine whether a specified attribute has values containing a specified string, also used to compare regular expressions to attribute values

4. Approximate indexes, based on metaphone approximation and useful for English language strings only, to determine whether a specified attribute has any values that sound like the specified string

5. International indexes, also called matching rule indexes, to expedite sorting and searching in accordance with the language rules of a particular locale

The dsconf command does not help you configure virtual list view, also known as browsing, indexes.

The dsconf command does help you assign all IDs threshold values to indexes. As the number of entries and attribute values grows in a directory, the number of attribute values to index also grows, as does therefore the size of the indexes. In some deployments a server can end up maintaining index lists so large that the cost of rebuilding an index when attributes are modified or added outweighs the benefit the index provides for searches. All IDs thresholds limit the growth of large indexes by definining the maximum number of entry identifiers Directory Server maintains in an index list. You can define all IDs thresholds for individual indexes and for some types of indexes.

Some indexes are maintained by the server for its own use. These are called system indexes. In general, do not modify or remove systems indexes; such modifications could have severe repercussions on performance.

See Directory Server Indexing in Oracle Fusion Middleware Reference for Oracle Directory Server Enterprise Edition for further details about indexing.

PROPERTY: all-ids-threshold

Syntax	INTEGER | inherited
Default Value	inherited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the maximum number of entry IDs the server maintains in an index list for the specified attribute type. By default its value is inherited from the all-ids-threshold setting for the suffix, whose default value in turn is inherited from the all-ids-threshold setting for the server, which by default is 4000. In addition to inheritance of default settings, this property handles settings as follows:

inherited

The threshold is inherited from the more global setting.

<2000

The threshold value is rounded up to 2000.

>2000

The setting is used as a guaranteed minimum threshold. Because of internal mechanisms, the real value can be slightly more than the specified value.

After you modify this property, reindex the attribute for which you changed the threshold. For example:

$ dsconf set-index-prop dc=example,dc=com uid all-ids-threshold:5000 $ dsconf reindex -t uid dc=example,dc=com ## example: Indexing attribute: uid ## example: Finished indexing. Task completed (slapd exit code: 0). $

PROPERTY: all-ids-threshold-eq

Syntax	INTEGER | inherited
Default Value	inherited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the all IDs threshold for equality indexes of the specified attribute. By default its value is inherited from the all-ids-threshold setting for the attribute type. See all-ids-threshold(5dsconf) for more information.

PROPERTY: all-ids-threshold-pres

Syntax	INTEGER | inherited
Default Value	inherited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the all IDs threshold for presence indexes of the specified attribute. By default its value is inherited from the all-ids-threshold setting for the attribute type. See all-ids-threshold(5dsconf) for more information.

PROPERTY: all-ids-threshold-sub

Syntax	INTEGER | inherited
Default Value	inherited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the all IDs threshold for substring indexes of the specified attribute. By default its value is inherited from the all-ids-threshold setting for the attribute type. See all-ids-threshold(5dsconf) for more information.

PROPERTY: approx-enabled

Syntax	on|off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether approximate indexes are maintained for the specified attribute type. You cannot set an all IDs threshold value for approximate indexes.

PROPERTY: desc

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

Use this optional property to provide a short description of the index configuration.

PROPERTY: eq-enabled

Syntax	on|off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether equality indexes are maintained for the specified attribute type.

PROPERTY: matching-rule

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the matching rule indexes maintained for the specified attribute type.

Values for this property must be valid collation order object identifiers (OIDs). See Directory Server Internationalized Directory in Directory Server Enterprise Edition Reference for the OIDs corresponding to supported locales.

PROPERTY: pres-enabled

Syntax	on|off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether presence indexes are maintained for the specified attribute type.

PROPERTY: sub-enabled

Syntax	on|off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether substring indexes are maintained for the specified attribute type.

PROPERTY: system

Syntax	true|false
Default Value	false
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property identifies whether the specified index is a system index, and therefore should be left alone.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), desc(5dsconf)

ODSEE 11.1.1.3.0  Last Revised June 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

thread-count(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

server, check-schema-enabled, check-syntax-enabled, compat-flag, config-magic-number, db-batched-transaction-count, db-cache-size, db-checkpoint-interval, db-env-path, db-lock-count, db-log-buf-size, db-log-path, def-repl-manager-pwd, def-repl-manager-pwd-file, dn-cache-count, dn-cache-size, dsml-answer-size, dsml-buffer-size, dsml-client-auth-mode, dsml-enabled, dsml-max-parser-count, dsml-min-parser-count, dsml-port, dsml-relative-root-url, dsml-request-max-size, dsml-secure-port, file-descriptor-count, heap-high-threshold-size, heap-low-threshold-size, host-access-dir-path, idle-timeout, import-cache-size, instance-path, ldap-port, ldap-secure-port, listen-address, look-through-limit, max-psearch-count, max-thread-count, max-thread-per-connection-count, mod-tracking-enabled, polling-thread-count, pwd-accept-hashed-pwd-enabled, pwd-check-enabled, pwd-compat-mode, pwd-expire-no-warning-enabled, pwd-expire-warning-delay, pwd-failure-count-interval, pwd-grace-login-limit, pwd-keep-last-auth-time-enabled, pwd-lockout-duration, pwd-lockout-enabled, pwd-lockout-repl-priority-enabled, pwd-max-age, pwd-max-failure-count, pwd-max-history-count, pwd-min-age, pwd-min-length, pwd-mod-gen-length, pwd-must-change-enabled, pwd-root-dn-bypass-enabled, pwd-safe-modify-enabled, pwd-storage-scheme, pwd-strong-check-dictionary-path, pwd-strong-check-enabled, pwd-strong-check-require-charset, pwd-supported-storage-scheme, pwd-user-change-enabled, read-write-mode, ref-integrity-attr, ref-integrity-check-delay, ref-integrity-enabled, repl-user-schema-enabled, require-bind-pwd-enabled, retro-cl-deleted-entry-attr, retro-cl-enabled, retro-cl-ignored-attr, retro-cl-max-age, retro-cl-max-entry-count, retro-cl-path, retro-cl-suffix-dn, root-dn, root-pwd, root-pwd-file, root-pwd-storage-scheme, search-size-limit, search-time-limit, secure-listen-address, ssl-cipher-family, ssl-client-auth-mode, ssl-enabled, ssl-rsa-cert-name, ssl-rsa-security-device, ssl-supported-ciphers, thread-count – DS server instance configuration (SER) properties

Description

The behavior of a Directory Server instance is configured according to server properties documented here and in the documentation specified under the SEE ALSO section.

PROPERTY: check-schema-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that entries being updated still conform to the server schema.

PROPERTY: check-syntax-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks that attribute values being updated have valid syntax. The server logs an error message when encountering an invalid value and prevents the update. When this property is set to on, the server checks updates to attribute values defined as Boolean, DN, Directory String, Generalized Time, IA5 String, INTEGER, or Telephone Number syntax. This behavior holds both for offline import and for normal write operations.

By default, syntax checking is off. When syntax checking is on, all import and update operations are checked. Directory Manager (directory super user) cannot bypass syntax checking.

Syntax is not checked on existing entries in the database. To clean up existing data, dump the database to LDIF, turn syntax checking on, and reload the database. Data that violates the syntax is visible in the errors log, and can be corrected and reloaded. You can also repair existing bad data by deleting or replacing the bad value using an LDAP client. If syntax checking is on, when a database is reloaded from LDIF, invalid syntax values are skipped and recorded in the errors log. Valid syntax values are reloaded.

PROPERTY: compat-flag

Syntax	none | no-rfc4511 | no-rfc4522
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

Flag which forces server to behave as in previous releases, for compatibility reasons.

The following values are accepted:

• none

  The server behavior is not altered.

• no-rfc4511

  RFC 4511 specifies that a search filter (such as (&(attr>=v1)(attr<=v2)) should return entries that have one value that is greater than or equal to v1 and one value that is less than or equal to v2. In previous versions of Directory Server, this filter was interpreted as entries with values in the range v1...v2 (which is more restrictive when the attribute is multi-valued. The Directory Server now implements the RFC 4511 behavior by default, unless compat-flag is set to no-rfc4511.

• no-rfc4522

  RFC 4522 clarifies the usage of the binary qualifier in attribute names. It states that an LDAP search response should always append the binary qualifier to the attribute name whenever its syntax allows the binary option and also when the attribute is requested without the binary qualifier. By default, version 7 implements RFC 4522 behavior. If compat-flag is set to no-rfc4522, the software implements version 6 behavior.

Application requests	Directory Server 6 responds	Directory Server 7 responds (without no-rfc4522)	Directory Server 7 responds (with no-rfc4522)
userCertificate	userCertificate	userCertificate;binary	userCertificate
userCertificate;binary	userCertificate;binary	userCertificate;binary	userCertificate;binary

PROPERTY: config-magic-number

Syntax	STRING
Default Value	D-A00
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies a value used by the Directory Server administration framework and tools to determine the capabilities of a server instance.

PROPERTY: db-batched-transaction-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many server transactions are gathered into a batch before being written to the transaction log. If writes to the transaction log are a bottleneck, you may potentially improve performance by increasing this value. Valid range is 0-30, 0 meaning that batching is turned off.

PROPERTY: db-cache-size

Syntax	MEMORY_SIZE
Default Value	32M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache indexes for all suffixes supported by the server instance. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: db-checkpoint-interval

Syntax	DURATION
Default Value	60s
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the interval between checkpoints recorded in the database transaction log.

PROPERTY: db-env-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a valid directory, unique to the server instance. There must be enough space available on the file system to house at least the actual size of the database cache.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: db-lock-count

Syntax	INTEGER
Default Value	20000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of locks available to the server instance database. Increase this value if you observe the following message in the errors log:

libdb: Lock table is out of available locks

PROPERTY: db-log-buf-size

Syntax	MEMORY_SIZE
Default Value	512k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the transaction log buffer size. Valid range is 0 to the size of the transaction log, which is 10M by default.

After changing this property, you must restart the server in order to take the change into account.

PROPERTY: db-log-path

Syntax	PATH
Default Value	instance-path/db
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory containing the database transaction log.

When changing this property, you must stop the server, delete the existing database, and reimport all suffixes from LDIF, before restarting the server.

PROPERTY: def-repl-manager-pwd

Syntax	STRING
Default Value	See the description that follows.
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property lets you read the password used for replication binds performed using simple authentication. Either you specify the password before setting up replication by setting def-repl-manager-pwd-file to specify the file containing the password you want to use, or you accept the password value generated by the dsconf accord-replication subcommand.

PROPERTY: def-repl-manager-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the default replication password is read and stored for future use when setting up replication.

PROPERTY: dn-cache-count

Syntax	INTEGER | unlimited | disabled
Default Value	unlimited
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of number of entries. The value of dn-cache-count is unlimited by default. The value of dn-cache-count can be an integer, unlimited, and disabled and each of these has the following effect on dn-cache-size.

• unlimited — cache is limited to the cache size specified for dn-cache-size.

• disabled — caching is disabled and dn-cache-size is ignored.

• INTEGER — cache is limited to the number of DNs specified by the value that you provide and dn-cache-size is ignored. The value must be 1 or greater than 1.

Changing this property requires you to restart the server.

PROPERTY: dn-cache-size

Syntax	MEMORY_SIZE
Default Value	10M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the DN cache in terms of memory space. This property is set by default. The cache size must be larger than 1M. The DN cache size specified for this property is taken into account only when dn-cache-count is set to unlimited.

Changing this property requires you to restart the server.

PROPERTY: dsml-answer-size

Syntax	MEMORY_SIZE
Default Value	64k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size of a server response to a DSML request. Larger responses are chunked.

PROPERTY: dsml-buffer-size

Syntax	MEMORY_SIZE
Default Value	8k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the size of the buffer used to store DSML requests. If the server receives many DSML requests larger than this limit, increase the buffer size.

PROPERTY: dsml-client-auth-mode

Syntax	clientCertOnly | httpBasicOnly | clientCertFirst
Default Value	httpBasicOnly
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how the server identifies a client application. The following settings are supported.

clientCertOnly

Use credentials from the client certificate to identify the client.

httpBasicOnly

Use credentials from the HTTP authorization header to identify the client.

clientCertFirst

Attempt to use the client certificate credentials to identify the client. If there are no client certificate credentials, credentials from the HTTP authorization header are used.

PROPERTY: dsml-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts DSML requests.

PROPERTY: dsml-max-parser-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-min-parser-count

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of DSML parsers allocated to handle client requests. Increase the value of this property if the server must handle sustained, high numbers of DSML client requests.

PROPERTY: dsml-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests. Changing the value requires that you restart the server.

PROPERTY: dsml-relative-root-url

Syntax	STRING
Default Value	/dsml
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the root URL HTTP clients should specify in their POST requests.

PROPERTY: dsml-request-max-size

Syntax	MEMORY_SIZE
Default Value	32k
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum size for DSML client requests.

PROPERTY: dsml-secure-port

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port number on which the server listens for DSML requests over HTTPS. Changing the value requires that you restart the server.

PROPERTY: file-descriptor-count

Syntax	INTEGER
Default Value	1024
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of file descriptors the server instance attempts to use to handle client requests. Increase this value if you observe the following message in the errors log:

Not listening for new connections -- too many fds open

PROPERTY: heap-high-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies a threshold value for the dynamic memory footprint. When the threshold memory is reached, Directory Server attempts to free memory from the entry caches, and to limit memory use.

• When heap-low-threshold-size is reached, Directory Server attempts to free memory concurrently with other operations.

• When heap-high-threshold-size is reached, Directory Server prevents operations on the cache while memory is freed.

heap-high-threshold-size and heap-low-threshold-size must be configured in conjunction with each other, as follows.

• If heap-high-threshold-size is set to undefined or is not set, heap-low-threshold-size is ignored.

• If heap-high-threshold-size is set, its value must be at least one gigabyte.

• If heap-high-threshold-size is set, the value of heap-low-threshold-size must be less than that of heap-high-threshold-size. If not, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size is set to a value other than undefined, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

• If heap-high-threshold-size and heap-low-threshold-size are both set to a value other than undefined, heap-low-threshold-size must be greater than or equal to (heap-high-threshold-size + minheap)/2, where minheap is the amount of heap memory used by the server at startup. If this condition is not met, heap-low-threshold-size is automatically set by default to 7/8 of the value of heap-high-threshold-size.

The number of times the memory thresholds have been exceeded can be monitored by using the heapmaxhighhits and heapmaxlowhits attributes on cn=monitor.

PROPERTY: heap-low-threshold-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

See the description for heap-high-threshold-size.

PROPERTY: host-access-dir-path

Syntax	PATH | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the local directory path on the server host where hosts.allow and hosts.deny files are located. If this property is not set, or if the files are not found, Directory Server does not enable the additional connection-based access controls provided by these files.

PROPERTY: idle-timeout

Syntax	INTEGER | none
Default Value	none
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many seconds the server waits for traffic on an idle LDAP client connection before closing the connection.

PROPERTY: import-cache-size

Syntax	MEMORY_SIZE
Default Value	64M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the amount of physical memory Directory Server requests from the operating system to cache data used when initializing a suffix from LDIF. See Directory Server Data Caching in Directory Server Enterprise Edition Reference for suggestions on sizing cache.

PROPERTY: instance-path

Syntax	PATH
Default Value	Path set at server creation
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the file system directory under which the server instance was created using the dsadm create command.

PROPERTY: ldap-port

Syntax	INTEGER | disabled
Default Value	389 | 1389
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAP client requests. The default port is 389 when the instance is created by the system super user, 1389 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: ldap-secure-port

Syntax	INTEGER | disabled
Default Value	636 | 1636
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the port on which the server listens for LDAPS client requests using TLS or SSL. The default port is 636 when the instance is created by the system super user, 1636 otherwise. Changing this property requires that you restart the server.

If you set both ldap-port and ldap-secure-port to disabled, you can no longer use dsconf to configure the server.

PROPERTY: listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the regular LDAP port. You can specify more than one listen address for the same port number. The default listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: look-through-limit

Syntax	INTEGER | unlimited
Default Value	5000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server examines when checking candidates to respond to a search request.

PROPERTY: max-psearch-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number persistent searches allowed. You can read the number of active persistent searches in the value of currentpsearches on cn=monitor.

PROPERTY: max-thread-count

Syntax	INTEGER
Default Value	30
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of threads created at startup to process operations. When tuning server performance, try setting this to twice the number of processors or 20 plus the number of simultaneous updates expected. You can read the number of active threads in the value of threads on cn=monitor.

PROPERTY: max-thread-per-connection-count

Syntax	INTEGER
Default Value	5
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of concurrent threads used to process operations on a single connection.

PROPERTY: mod-tracking-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains modification timestamps for updated entries.

PROPERTY: polling-thread-count

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property is not supported on Microsoft Windows platforms. This property is not supported in releases prior to Directory Server Enterprise Edition version 6.3.

Changing the value requires the server to be restarted.

PROPERTY: pwd-accept-hashed-pwd-enabled

Syntax	on | off
Default Value	N/A
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts modifications with hashed password values without checking their content. This property takes effect only when pwd-check-enabled is on.

PROPERTY: pwd-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks the quality of password values when they are modified.

PROPERTY: pwd-compat-mode

Syntax	DS5-compatible-mode | DS6-migration-mode | DS6-mode
Default Value	DS5-compatible-mode
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password policy compatibility mode for the server. Change it using dsconf pwd-compat. See Oracle Fusion Middleware Administration Guide for Oracle Directory Server Enterprise Edition for details on password policy.

PROPERTY: pwd-expire-no-warning-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether a password can expire without prior warning to a client application.

PROPERTY: pwd-expire-warning-delay

Syntax	DURATION | disabled
Default Value	1d
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the duration preceding password expiration during which the server returns warnings about the password expiring to client applications binding using the password.

PROPERTY: pwd-failure-count-interval

Syntax	DURATION | disabled
Default Value	10m
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which password failures are purged from the failure count.

PROPERTY: pwd-grace-login-limit

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of times an expired password can be used to authenticate.

PROPERTY: pwd-keep-last-auth-time-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether to record authentication times in the pwdLastAuthTime operational attribute on user entries.

PROPERTY: pwd-lockout-duration

Syntax	DURATION | disabled
Default Value	1h
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the how long before the server unlocks an account that is locked.

PROPERTY: pwd-lockout-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server locks accounts after a specified number, pwd-max-failure-count, of consecutive failed attempts to bind.

PROPERTY: pwd-lockout-repl-priority-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether password lockout attributes are replicated with high priority.

PROPERTY: pwd-max-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the age beyond which a password expires.

PROPERTY: pwd-max-failure-count

Syntax	INTEGER | disabled
Default Value	3
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of consecutive failed bind attempts after which the password may not be used to authenticate to the server.

PROPERTY: pwd-max-history-count

Syntax	INTEGER | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of password values stored in the password history of the entry. These values cannot be used again until they are no longer present in the history.

PROPERTY: pwd-min-age

Syntax	DURATION | disabled
Default Value	disabled
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum duration between password modifications.

PROPERTY: pwd-min-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the minimum number of characters allowed in a password value when quality checking has been enabled.

PROPERTY: pwd-mod-gen-length

Syntax	INTEGER | disabled
Default Value	6
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the length of the password generated by Directory Server when a password is reset using the LDAP Password Modify Extended Operation defined in RFC 3062 and no new password value is specified.

Although the syntax for this property is integer, its value must be between 6 and 512, inclusive.

PROPERTY: pwd-must-change-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the password must be changed after the initial client bind after the password has been set or reset by another user.

PROPERTY: pwd-root-dn-bypass-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the directory super user is allowed to update passwords with values that violate password policy.

PROPERTY: pwd-safe-modify-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the current password must be provided with the request to modify the password.

PROPERTY: pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encode password values.

PROPERTY: pwd-strong-check-dictionary-path

Syntax	PATH | none
Default Value	instance-path/plugins/words-english-big.txt
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the path to the dictionary file used for strong password checks.

PROPERTY: pwd-strong-check-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server checks new password values to ensure they match with pwd-strong-check-require-charset settings, and do not match records in the dictionary file.

PROPERTY: pwd-strong-check-require-charset

Syntax	lower | upper | digit | special | any-two | any-three
Default Value	lower && upper && digit && special
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the sets of characters that must be present in a password value modification.

lower

The new password must include a lower case character.

upper

The new password must include an upper case character.

digit

The new password must include a digit.

special

The new password must include a special character.

any-two

The new password must include at least one character from each of at least two of the abovementioned character sets.

any-three

The new password must include at least one character from each of at least three of the abovementioned character sets.

PROPERTY: pwd-supported-storage-scheme

Syntax	STRING
Default Value	See the following description.
Is readable	Yes
Is modifiable	No
Is multi-valued	Yes

This property specifies the set of encryption storage schemes supported for Directory Server user passwords. Supported storage schemes include CRYPT, SHA, SSHA, NS-MTA-MD5, and CLEAR.

PROPERTY: pwd-user-change-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether users may change their own passwords.

PROPERTY: read-write-mode

Syntax	read-only | read-write | frozen
Default Value	read-write
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the suffixes and configuration data on the server can be modified. Use frozen when quiescing a server for online file system backup.

PROPERTY: ref-integrity-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies attributes for which referential integrity must be checked on update.

PROPERTY: ref-integrity-check-delay

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the delay between referential integrity checks. The default is no delay.

PROPERTY: ref-integrity-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether referential integrity checks are performed by the server.

PROPERTY: repl-user-schema-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether only schema elements with X-ORIGIN of user-defined are replicated. This can be useful when replicating between server versions with schema that are not fully compatible.

PROPERTY: require-bind-pwd-enabled

Syntax	on | off
Default Value	on
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server rejects simple authentication attempts to bind that do not include a password.

PROPERTY: retro-cl-deleted-entry-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the attributes to record in the retro change log when an entry is deleted.

PROPERTY: retro-cl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server maintains a retro changelog of all changes occurring on the server instance.

PROPERTY: retro-cl-ignored-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the list of attributes not to record in the retro changelog when updates occur.

PROPERTY: retro-cl-max-age

Syntax	DURATION | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum age of records in the retro changelog. Older records are purged.

PROPERTY: retro-cl-max-entry-count

Syntax	INTEGER
Default Value	0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of records in the retro changelog. Older records are purged. The value 0 corresponds to an unlimited number.

PROPERTY: retro-cl-path

Syntax	PATH
Default Value	instance-path/db/changelog
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the file system directory in which the changelog is created.

PROPERTY: retro-cl-suffix-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the suffixes for which retro changelog records are maintained.

PROPERTY: root-dn

Syntax	DN
Default Value	cn=Directory Manager
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the Distinguished Name of the Directory Manager user, a user not subject to access controls.

PROPERTY: root-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property shows the password for the Directory Manager user. It shows hashed password according to the password storage scheme used.

PROPERTY: root-pwd-file

Syntax	PATH | ""
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file containing the password for the Directory Manager user. The file is read once, and the password is stored for future use.

PROPERTY: root-pwd-storage-scheme

Syntax	STRING
Default Value	SSHA
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the algorithm used to encrypt the password for the Directory Manager user. It must be one of the schemes specified by the pwd-supported-storage-scheme property.

PROPERTY: search-size-limit

Syntax	INTEGER | unlimited
Default Value	2000
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of entries the server returns for a search operation.

PROPERTY: search-time-limit

Syntax	INTEGER | unlimited
Default Value	3600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the maximum number of seconds allocated by the server to respond to a search request.

PROPERTY: secure-listen-address

Syntax	STRING
Default Value	0.0.0.0
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the IP address at which the server listens for LDAP client requests using the secure LDAP port. You can specify more than one secure listen address for the same port number. The default secure listen address is 0.0.0.0. Changing this property requires that you restart the server.

PROPERTY: ssl-cipher-family

Syntax	STRING | all
Default Value	all
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the SSL ciphers the server can use for SSL communications. The default value, all, does not mean all the supported SSL ciphers, as supported ciphers with NULL key length are removed from the list.

PROPERTY: ssl-client-auth-mode

Syntax	allowed | required | disabled
Default Value	allowed
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server allows, requires, or does not allow SSL client authentication, in which the client application authenticates sending its SSL certificate to the server.

PROPERTY: ssl-enabled

Syntax	on | off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies whether the server accepts SSL connnections.

PROPERTY: ssl-rsa-cert-name

Syntax	STRING
Default Value	defaultCert
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the SSL certificate for the server.

PROPERTY: ssl-rsa-security-device

Syntax	STRING
Default Value	internal (software)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of the security device used by the server.

PROPERTY: ssl-supported-ciphers

Syntax	STRING
Default Value	Depends on underlying SSL library
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the full list of SSL ciphers the server can support.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), all-ids-threshold(5dsconf), db-path(5dsconf), moddn-enabled(5dsconf), referral-url(5dsconf)

ODSEE 11.1.1.3.0  Last Revised July 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

transport-compression(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

repl-agmt, auth-bind-dn, auth-protocol, auth-pwd, repl-fractional-exclude-attr, repl-fractional-include-attr, repl-schedule, transport-compression, transport-group-size, transport-window-size – DS replication agreement configuration (RAG) properties

Description

A replication agreement governs how a Directory Server supplier updates a Directory Server consumer. Although this configuration element is called an agreement, it concerns the configuration only of the supplier.

PROPERTY: auth-bind-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the bind DN used by the supplier to bind to the consumer in order to perform replication-related updates. This bind DN must be present on the consumer.

PROPERTY: auth-protocol

Syntax	clear|ssl-simple|ssl-client
Default Value	clear
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the protocol used by the supplier to bind to the consumer in order to perform replication-related updates. The default is to bind with simple authentication in clear text without securing the connection, as most replications connections are made on an internal network. You may however configure replication to use SSL and simple authentication to protect the connection from malicious snooping, or SSL with client authentication to further protect the connection.

PROPERTY: auth-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password used by the supplier to bind to the consumer. You provide it using auth-pwd-file.

PROPERTY: auth-pwd-file

Syntax	PATH
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the bind password for replication is read to create the replication agreement. The file is read once on replication agreement creation, and the password is stored for future use.

PROPERTY: repl-fractional-exclude-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the list of attributes not to replicate. This property is mutually exclusive with repl-fractional-include-attr.

PROPERTY: repl-fractional-include-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the list of attributes to replicate. This property is mutually exclusive with repl-fractional-exclude-attr.

PROPERTY: repl-schedule

Syntax	INTERVAL | always
Default Value	always
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the times and days when replication can take place.

PROPERTY: transport-compression

Syntax	best-compression | best-speed | default-compression | no-compression
Default Value	no-compression
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the level of libz(3) compression used on replication updates from the supplier to the consumer. Supported settings are as follows.

no-compression

No compression

default-compression

Default zlib compression (zlib numeric value = -1)

best-speed

Fastest zlib compression (zlib numeric value = 1)

best-compression

Strongest zlib compression (zlib numeric value = 9)

If the bottleneck for replication in your environment is network bandwidth, this property can potentially help you tune the replication protocol for better performance.

PROPERTY: transport-group-size

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many replication messages are grouped on the supplier before being sent to the consumer. Valid range is 1 to 255.

If the bottleneck for replication in your environment is network bandwidth, this property can potentially help you tune the replication protocol for better performance.

PROPERTY: transport-window-size

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of replication messages sent from the supplier to the consumer before waiting for a response from the consumer to continue. Valid range is 1 to 65535.

If the bottleneck for replication in your environment is network latency or network bandwidth, this property can potentially help you tune the replication protocol for better performance.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), desc(5dsconf), enabled(5dsconf)

ODSEE 11.1.1.3.0  Last Revised June 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

transport-group-size(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

repl-agmt, auth-bind-dn, auth-protocol, auth-pwd, repl-fractional-exclude-attr, repl-fractional-include-attr, repl-schedule, transport-compression, transport-group-size, transport-window-size – DS replication agreement configuration (RAG) properties

Description

A replication agreement governs how a Directory Server supplier updates a Directory Server consumer. Although this configuration element is called an agreement, it concerns the configuration only of the supplier.

PROPERTY: auth-bind-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the bind DN used by the supplier to bind to the consumer in order to perform replication-related updates. This bind DN must be present on the consumer.

PROPERTY: auth-protocol

Syntax	clear|ssl-simple|ssl-client
Default Value	clear
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the protocol used by the supplier to bind to the consumer in order to perform replication-related updates. The default is to bind with simple authentication in clear text without securing the connection, as most replications connections are made on an internal network. You may however configure replication to use SSL and simple authentication to protect the connection from malicious snooping, or SSL with client authentication to further protect the connection.

PROPERTY: auth-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password used by the supplier to bind to the consumer. You provide it using auth-pwd-file.

PROPERTY: auth-pwd-file

Syntax	PATH
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the bind password for replication is read to create the replication agreement. The file is read once on replication agreement creation, and the password is stored for future use.

PROPERTY: repl-fractional-exclude-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the list of attributes not to replicate. This property is mutually exclusive with repl-fractional-include-attr.

PROPERTY: repl-fractional-include-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the list of attributes to replicate. This property is mutually exclusive with repl-fractional-exclude-attr.

PROPERTY: repl-schedule

Syntax	INTERVAL | always
Default Value	always
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the times and days when replication can take place.

PROPERTY: transport-compression

Syntax	best-compression | best-speed | default-compression | no-compression
Default Value	no-compression
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the level of libz(3) compression used on replication updates from the supplier to the consumer. Supported settings are as follows.

no-compression

No compression

default-compression

Default zlib compression (zlib numeric value = -1)

best-speed

Fastest zlib compression (zlib numeric value = 1)

best-compression

Strongest zlib compression (zlib numeric value = 9)

If the bottleneck for replication in your environment is network bandwidth, this property can potentially help you tune the replication protocol for better performance.

PROPERTY: transport-group-size

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many replication messages are grouped on the supplier before being sent to the consumer. Valid range is 1 to 255.

If the bottleneck for replication in your environment is network bandwidth, this property can potentially help you tune the replication protocol for better performance.

PROPERTY: transport-window-size

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of replication messages sent from the supplier to the consumer before waiting for a response from the consumer to continue. Valid range is 1 to 65535.

If the bottleneck for replication in your environment is network latency or network bandwidth, this property can potentially help you tune the replication protocol for better performance.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), desc(5dsconf), enabled(5dsconf)

ODSEE 11.1.1.3.0  Last Revised June 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

transport-window-size(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

repl-agmt, auth-bind-dn, auth-protocol, auth-pwd, repl-fractional-exclude-attr, repl-fractional-include-attr, repl-schedule, transport-compression, transport-group-size, transport-window-size – DS replication agreement configuration (RAG) properties

Description

A replication agreement governs how a Directory Server supplier updates a Directory Server consumer. Although this configuration element is called an agreement, it concerns the configuration only of the supplier.

PROPERTY: auth-bind-dn

Syntax	DN | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the bind DN used by the supplier to bind to the consumer in order to perform replication-related updates. This bind DN must be present on the consumer.

PROPERTY: auth-protocol

Syntax	clear|ssl-simple|ssl-client
Default Value	clear
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the protocol used by the supplier to bind to the consumer in order to perform replication-related updates. The default is to bind with simple authentication in clear text without securing the connection, as most replications connections are made on an internal network. You may however configure replication to use SSL and simple authentication to protect the connection from malicious snooping, or SSL with client authentication to further protect the connection.

PROPERTY: auth-pwd

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	No
Is multi-valued	No

This property specifies the password used by the supplier to bind to the consumer. You provide it using auth-pwd-file.

PROPERTY: auth-pwd-file

Syntax	PATH
Default Value	""
Is readable	No
Is modifiable	Yes
Is multi-valued	No

This property specifies the file from which the bind password for replication is read to create the replication agreement. The file is read once on replication agreement creation, and the password is stored for future use.

PROPERTY: repl-fractional-exclude-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the list of attributes not to replicate. This property is mutually exclusive with repl-fractional-include-attr.

PROPERTY: repl-fractional-include-attr

Syntax	ATTR_NAME | ""
Default Value	""
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the list of attributes to replicate. This property is mutually exclusive with repl-fractional-exclude-attr.

PROPERTY: repl-schedule

Syntax	INTERVAL | always
Default Value	always
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies the times and days when replication can take place.

PROPERTY: transport-compression

Syntax	best-compression | best-speed | default-compression | no-compression
Default Value	no-compression
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the level of libz(3) compression used on replication updates from the supplier to the consumer. Supported settings are as follows.

no-compression

No compression

default-compression

Default zlib compression (zlib numeric value = -1)

best-speed

Fastest zlib compression (zlib numeric value = 1)

best-compression

Strongest zlib compression (zlib numeric value = 9)

If the bottleneck for replication in your environment is network bandwidth, this property can potentially help you tune the replication protocol for better performance.

PROPERTY: transport-group-size

Syntax	INTEGER
Default Value	1
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies how many replication messages are grouped on the supplier before being sent to the consumer. Valid range is 1 to 255.

If the bottleneck for replication in your environment is network bandwidth, this property can potentially help you tune the replication protocol for better performance.

PROPERTY: transport-window-size

Syntax	INTEGER
Default Value	10
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the number of replication messages sent from the supplier to the consumer before waiting for a response from the consumer to continue. Valid range is 1 to 65535.

If the bottleneck for replication in your environment is network latency or network bandwidth, this property can potentially help you tune the replication protocol for better performance.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), desc(5dsconf), enabled(5dsconf)

ODSEE 11.1.1.3.0  Last Revised June 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

type(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

plugin, argument, depends-on-named, depends-on-type, feature, init-func, lib-path, type, vendor, version – DS plug-in configuration (PLG) properties

Description

Directory Server implements some key functionality as plug-ins. Plug-ins take the form of libraries loaded when the server starts, and called at different points in the processing of client application requests. When you create custom plug-ins, you must configure the server to load and use them, then restart Directory Server to load the newly configured plug-ins.

PROPERTY: argument

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies arguments passed to the plug-in when it is loaded by Directory Server. Arguments are passed in the order you specify them. Updating the list of arguments replaces all the existing arguments previously specified when the plug-in is loaded again.

PROPERTY: depends-on-named

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies names of plug-ins that must be available and loaded before Directory Server loads the current plug-in.

PROPERTY: depends-on-type

Syntax	STRING (See the description that follows.)
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies types of plug-ins that must be available and loaded before Directory Server loads the current plug-in. The value must be the value of a plug-in type property.

PROPERTY: feature

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the plug-in identifier from the Slapi_PluginDesc structure.

PROPERTY: init-func

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of function called by Directory Server to initialize the plug-in.

PROPERTY: lib-path

Syntax	PATH
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the absolute file system path to the library containing plug-in.

PROPERTY: type

Syntax	STRING (See the description that follows.)
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the plug-in type. The following plug-in types are supported.

ldbmentryfetchstore

Entry store and fetch plug-in

extendedop

Extended operation plug-in

passwordcheck

Password check plug-in

postoperation

Post-operation plug-in

preoperation

Pre-operation plug-in

internalpostoperation

Internal post-operation plug-in

internalpreoperation

Internal pre-operation plug-in

matchingrule

Matching rule plug-in for extensible match search filters

object

Generic plug-in type, sometimes used to register other plug-ins

passwordcheck

Strong password check plug-in

pwdstoragescheme

Password storage scheme plug-in

PROPERTY: vendor

Syntax	STRING
Default Value	Vendor name in plug-in configuration
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the plug-in vendor from the Slapi_PluginDesc structure.

PROPERTY: version

Syntax	STRING
Default Value	Version string in plug-in configuration
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the plug-in version from the Slapi_PluginDesc structure.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Stable

See Also

dsconf(1M), desc(5dsconf), enabled(5dsconf)

ODSEE 11.1.1.3.0  Last Revised June 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

useAuthzIdForAuditAttrs(5dsconf)

Name | Description | Attributes | See Also

Name

useAuthzIdForAuditAttrs – record proxied authorization information

Description

Specifies whether Directory Server records the authentication ID, such as the bind DN, of the proxy acting on behalf of the user, or the authorization ID of the user for whom the proxy is requesting the operation.

When useAuthzIdForAuditAttrs is set to on, Directory Server records the authorization ID in the creatorsName or modifiersName during a write operation on an entry. By default Directory Server records the authentication ID.

Entry DN

cn=config

Valid range

on | off

Default value

off

Syntax

DirectoryString

Example

useAuthzIdForAuditAttrs: on

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Obsolete: Scheduled for removal after this release

See Also

dse.ldif(4)

ODSEE 11.1.1.3.0  Last Revised October 5, 2006

Name | Description | Attributes | See Also

vendor(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

plugin, argument, depends-on-named, depends-on-type, feature, init-func, lib-path, type, vendor, version – DS plug-in configuration (PLG) properties

Description

Directory Server implements some key functionality as plug-ins. Plug-ins take the form of libraries loaded when the server starts, and called at different points in the processing of client application requests. When you create custom plug-ins, you must configure the server to load and use them, then restart Directory Server to load the newly configured plug-ins.

PROPERTY: argument

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies arguments passed to the plug-in when it is loaded by Directory Server. Arguments are passed in the order you specify them. Updating the list of arguments replaces all the existing arguments previously specified when the plug-in is loaded again.

PROPERTY: depends-on-named

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies names of plug-ins that must be available and loaded before Directory Server loads the current plug-in.

PROPERTY: depends-on-type

Syntax	STRING (See the description that follows.)
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies types of plug-ins that must be available and loaded before Directory Server loads the current plug-in. The value must be the value of a plug-in type property.

PROPERTY: feature

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the plug-in identifier from the Slapi_PluginDesc structure.

PROPERTY: init-func

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of function called by Directory Server to initialize the plug-in.

PROPERTY: lib-path

Syntax	PATH
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the absolute file system path to the library containing plug-in.

PROPERTY: type

Syntax	STRING (See the description that follows.)
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the plug-in type. The following plug-in types are supported.

ldbmentryfetchstore

Entry store and fetch plug-in

extendedop

Extended operation plug-in

passwordcheck

Password check plug-in

postoperation

Post-operation plug-in

preoperation

Pre-operation plug-in

internalpostoperation

Internal post-operation plug-in

internalpreoperation

Internal pre-operation plug-in

matchingrule

Matching rule plug-in for extensible match search filters

object

Generic plug-in type, sometimes used to register other plug-ins

passwordcheck

Strong password check plug-in

pwdstoragescheme

Password storage scheme plug-in

PROPERTY: vendor

Syntax	STRING
Default Value	Vendor name in plug-in configuration
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the plug-in vendor from the Slapi_PluginDesc structure.

PROPERTY: version

Syntax	STRING
Default Value	Version string in plug-in configuration
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the plug-in version from the Slapi_PluginDesc structure.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Stable

See Also

dsconf(1M), desc(5dsconf), enabled(5dsconf)

ODSEE 11.1.1.3.0  Last Revised June 2010

Name | Description | SYNTAX VALUES | Attributes | See Also

verbose-enabled(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

log, buffering-enabled, level, max-age, max-disk-space-size, max-file-count, max-size, min-free-disk-space-size, path, perm, rotation-interval, rotation-min-file-size, rotation-time, verbose-enabled – DS logging configuration (LOG) properties

Description

Directory Server writes to three main types of log files you can configure, the INSTANCE_PATH/logs/access, INSTANCE_PATH/logs/audit, and INSTANCE_PATH/logs/errors logs, where INSTANCE_PATH is the full path where the server instance is located, such as /local/dsInst.

When you specify one of these properties with dsconf get-log-prop or dsconf set-log-prop, you must specify which type of log configuration, access, audit, or error, you want to examine. For example, to see whether audit logging is enabled for a server instance:

$ dsconf get-log-prop audit enabled enabled : off $

PROPERTY: buffering-enabled

Syntax	on | off
Default Value	on for access, not applicable to audit and errors logs
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property indicates whether Directory Server writes access log entries directly to disk, or use a buffer, by default.

PROPERTY: enabled

Syntax	on | off
Default Value	on for access, off for audit, on for errors
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property indicates whether the specified log type is enabled.

PROPERTY: level

Syntax	See the description that follows.
Default Value	default
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property defines which kinds of messages get logged. This property is applicable only to access and errors logs.

access log levels

The following settings are supported:

acc-internal

Log access information for internal operations.

default

Log client access to entries.

acc-default_plus_referrals

As default, but also log access to referrals.

acc-timing

Use precise timing for microsecond resolution of elapsed times.

errors log levels

The following settings are supported:

default

Log startup, shutdown, errors, and warnings.

err-function-calls

Log when server enters or exits a function.

err-search-args

Log search arguments.

err-connection

Connection management.

err-packets

Log packets sent and received.

err-search-filter

Log search filter information.

err-config-file

Log information for changes to the configuration file dse.ldif.

err-acl

Log access control processing information.

err-ldbm

Log information from the ldbm database plugin.

err-entry-parsing

Log LDIF parsing errors.

err-housekeeping

Log event queue information.

err-replication

Log information about replication operations.

err-entry-cache

Log entry cache information.

err-plugins

Log information from server plug-ins.

err-dsml

Log information from DSML front end.

err-dsml-advanced

Debugging information for DSML.

PROPERTY: max-age

Syntax	DURATION | unlimited
Default Value	1M (one month)
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the age beyond which the specified type of log file is deleted.

PROPERTY: max-disk-space-size

Syntax	MEMORY_SIZE | unlimited
Default Value	500M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the maximum disk space the specified type of log is allowed to consume. When the limit is reached, the server deletes the oldest log file to reclaim disk space.

PROPERTY: max-file-count

Syntax	Integer
Default Value	10 for access, 2 for errors, 1 for audit
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the maximum number of log files, including rotated logs, of the specified type that the server allows to be created in the log file directory. When the limit is reached, the server deletes the oldest log file to reclaim disk space.

When you set this property to 1, the specified log is not rotated.

PROPERTY: max-size

Syntax	MEMORY_SIZE | unlimited
Default Value	100M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the maximum file size for the specified log. When the limit is reached, the server rotates the log file, unless max-file-count is set to 1.

PROPERTY: min-free-disk-space-size

Syntax	MEMORY_SIZE
Default Value	5M
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the minimum free space allowed on the disk where the specified log is stored. When the limit is reached, the server deletes the oldest log files until enough space is available.

PROPERTY: path

Syntax	PATH
Default Value	INSTANCE_PATH/logs/access, INSTANCE_PATH/logs/audit, INSTANCE_PATH/logs/errors
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the full path to the specified log file type.

PROPERTY: perm

Syntax	OCTAL_MODE
Default Value	600
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the read, write, and execute permissions on the specified log file.

PROPERTY: rotation-interval

Syntax	DURATION | unlimited
Default Value	1d (one day) for access, 1w (one week) for audit and errors
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the duration between rotations of the specified log file.

PROPERTY: rotation-min-file-size

Syntax	MEMORY_SIZE | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the minimum size the specified log file must have before the server rotates it.

PROPERTY: rotation-time

Syntax	TIME | undefined
Default Value	undefined
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property defines the time of day when the server rotates the specified log file.

PROPERTY: verbose-enabled

Syntax	on|off
Default Value	off
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property determines whether extra informational messages are written to the errors log.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Evolving

See Also

dsconf(1M), enabled(5dsconf)

ODSEE 11.1.1.3.0  Last Revised April 12, 2007

Name | Description | SYNTAX VALUES | Attributes | See Also

version(5dsconf)

Name | Description | SYNTAX VALUES | Attributes | See Also

Name

plugin, argument, depends-on-named, depends-on-type, feature, init-func, lib-path, type, vendor, version – DS plug-in configuration (PLG) properties

Description

Directory Server implements some key functionality as plug-ins. Plug-ins take the form of libraries loaded when the server starts, and called at different points in the processing of client application requests. When you create custom plug-ins, you must configure the server to load and use them, then restart Directory Server to load the newly configured plug-ins.

PROPERTY: argument

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies arguments passed to the plug-in when it is loaded by Directory Server. Arguments are passed in the order you specify them. Updating the list of arguments replaces all the existing arguments previously specified when the plug-in is loaded again.

PROPERTY: depends-on-named

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies names of plug-ins that must be available and loaded before Directory Server loads the current plug-in.

PROPERTY: depends-on-type

Syntax	STRING (See the description that follows.)
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	Yes

This property specifies types of plug-ins that must be available and loaded before Directory Server loads the current plug-in. The value must be the value of a plug-in type property.

PROPERTY: feature

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the plug-in identifier from the Slapi_PluginDesc structure.

PROPERTY: init-func

Syntax	STRING
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the name of function called by Directory Server to initialize the plug-in.

PROPERTY: lib-path

Syntax	PATH
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the absolute file system path to the library containing plug-in.

PROPERTY: type

Syntax	STRING (See the description that follows.)
Default Value	None
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the plug-in type. The following plug-in types are supported.

ldbmentryfetchstore

Entry store and fetch plug-in

extendedop

Extended operation plug-in

passwordcheck

Password check plug-in

postoperation

Post-operation plug-in

preoperation

Pre-operation plug-in

internalpostoperation

Internal post-operation plug-in

internalpreoperation

Internal pre-operation plug-in

matchingrule

Matching rule plug-in for extensible match search filters

object

Generic plug-in type, sometimes used to register other plug-ins

passwordcheck

Strong password check plug-in

pwdstoragescheme

Password storage scheme plug-in

PROPERTY: vendor

Syntax	STRING
Default Value	Vendor name in plug-in configuration
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the plug-in vendor from the Slapi_PluginDesc structure.

PROPERTY: version

Syntax	STRING
Default Value	Version string in plug-in configuration
Is readable	Yes
Is modifiable	Yes
Is multi-valued	No

This property specifies the plug-in version from the Slapi_PluginDesc structure.

SYNTAX VALUES

Syntax values shown in lower case or partly in lower case are literal values.

Those shown in upper case are syntax types, defined as follows:

ATTR_NAME

A valid attribute type name such as cn or objectClass.

BOOLEAN

true or false.

DN

A valid distinguished name such as ou=People,dc=example,dc=com.

DURATION

A duration specified in months (M), weeks (w), days (d), hours (h), minutes (m), seconds (s), and miliseconds (ms), or some combination with multiple specifiers. For example, you can specify one week as 1w, 7d, 168h, 10080m, or 604800s. You can also specify one week as 1w0d0h0m0s.

DURATION properties typically do not each support all duration specifiers (Mwdhms). Examine the output of dsconf help-properties for the property to determine which duration specifiers are supported.

EMAIL_ADDRESS

A valid e-mail address.

HOST_NAME

An IP address or host name.

INTEGER

A positive integer value between 0 and the maximum supported integer value in the system address space. On 32-bit systems, 2147483647. On 64-bit systems, 9223372036854775807.

INTERVAL

An interval value of the form hhmm-hhmm 0123456, where the first element specifies the starting hour, the next element the finishing hour in 24-hour time format, from 0000-2359, and the second specifies days, starting with Sunday (0) to Saturday (6).

IP_RANGE

An IP address or range of address in one of the following formats:

• IP address in dotted decimal form.

• IP address and bits, in the form of network number/mask bits.

• IP address and quad, in the form of a pair of dotted decimal quads.

• All address. A catch-all for clients that are note placed into other, higher priority groups.

• 0.0.0.0. This address is for groups to which initial membership is not considered. For example, for groups that clients switch to after their initial bind.

• IP address of the local host.

LDAP_URL

A valid LDAP URL as specified by RFC 2255.

MEMORY_SIZE

A memory size specified in gigabytes (G), megabytes (M),kilobytes (k), or bytes (b). Unlike DURATION properties, MEMORY_SIZE properties cannot combine multiple specifiers. However, MEMORY_SIZE properties allow decimal values, for example, 1.5M.

NAME

A valid cn (common name).

OCTAL_MODE

A three-digit, octal file permissions specifier. The first digit specifies permissions for the server user ID, the second for the server group ID, the last for other users. Each digit consists of a bitmask defining read (4), write (2), execute (1), or no access (0) permissions, thus 640 specifies read-write access for the server user, read-only access for other users of the server group, and no access for other users.

PASSWORD_FILE

The full path to the file from which the bind password should be read.

PATH

A valid, absolute file system path.

STRING

A DirectoryString value, as specified by RFC 2252.

SUPPORTED_SSL_CIPHER

An SSL cipher supported by the server. See the Reference for a list of supported ciphers.

SUPPORTED_SSL_PROTOCOL

An SSL protocol supported by the server. See the Reference for a list of supported protocols.

TIME

A time of the form hhmm in 24-hour format, where hh stands for hours and mm stands for minutes.

Attributes

See attributes(5) for descriptions of the following attributes:

ATTRIBUTE TYPE	ATTRIBUTE VALUE
Availability	SUNWdsee7
Stability Level	Stable

See Also

dsconf(1M), desc(5dsconf), enabled(5dsconf)

ODSEE 11.1.1.3.0  Last Revised June 2010

Name | Description | SYNTAX VALUES | Attributes | See Also