Chapter 22 Directory Proxy Server Distribution

For an overview of Directory Proxy Server distribution and a description of example use cases, see Chapter 17, Directory Proxy Server Distribution, in Sun Java System Directory Server Enterprise Edition 6.1 Reference.

This chapter covers the following topics:

• Creating and Configuring LDAP Data Views

• Renaming Attributes and DNs

• Configuring excluded-subtrees and alternate-search-base-dn

• Creating and Configuring Data Views for Example Use Cases

Creating and Configuring LDAP Data Views

For information about how to create and configure LDAP data views, see the following procedures:

To Create an LDAP Data View

You can use DSCC to perform this task. For information, see Directory Service Control Center Interface and the DSCC online help.

1. Create an LDAP data view.

   $ dpconf create-ldap-data-view -h host -p port view-name pool-name suffix-DN

   For information about how to modify the properties of an LDAP data view, see To Configure an LDAP Data View.

2. View the list of LDAP data views.

   $ dpconf list-ldap-data-views -h host -p port

To Configure an LDAP Data View

You can use DSCC to perform this task. For information, see Directory Service Control Center Interface and the DSCC online help.

1. View the properties of an LDAP data view.

   $ dpconf get-ldap-data-view-prop -h host -p port view-name

   If you create a data view without configuring any of the properties, your data view has the following configuration:

   alternate-search-base-dn : "" attr-name-mappings : none base-dn : suffix-DN contains-shared-entries : false custom-distribution-algorithm-class : none description : - distribution-algorithm : none dn-join-rule : none dn-mapping-attrs : none dn-mapping-source-base-dn : none excluded-subtrees : - filter-join-rule : none is-enabled : true is-read-only : false is-routable : true ldap-data-source-pool : pool-name lexicographic-attrs : all lexicographic-lower-bound : none lexicographic-upper-bound : none non-viewable-attr : none non-writable-attr : none numeric-attrs : all numeric-default-data-view : false numeric-lower-bound : none numeric-upper-bound : none pattern-matching-base-object-search-filter : all pattern-matching-dn-regular-expression : all pattern-matching-one-level-search-filter : all pattern-matching-subtree-search-filter : all process-bind : - replication-role : master viewable-attr : all except non-viewable-attr writable-attr : all except non-writable-attr

   ---

   Note –

   All users except the Proxy Manager see the cn=config and cn=monitor suffixes from the back-end server. By default, data from the back-end servers is not available to the Proxy Manager. The cn=config and cn=monitor subtrees that are available to the Proxy Manager are those of the proxy itself.

   When you create a Directory Proxy Server instance, a connection handler for the Proxy Manager is created with an empty data view policy. If the Proxy Manager requires access to back-end data, you must add a data view to the data view policy of the Proxy Manager connection handler. On such a data view, the cn=config and cn=monitor subtrees are excluded by default.

   ---

2. Change one or more of the properties that are listed in Step 1.

   $ dpconf set-ldap-data-view-prop -h host -p port view-name \ property:value [property:value ... ]

   For example, to access the dc=example,dc=com subtree on a data source, specify base-dn in the data view.

   $ dpconf set-ldap-data-view-prop -h host1 -p 1389 myDataView base-dn:dc=example,dc=com

   To add a value to a multi-valued property, use this command:

   $ dpconf set-ldap-data-view-prop -h host -p port view-name property+:value

   To remove a value from a multi-valued property, use this command:

   $ dpconf set-ldap-data-view-prop -h host -p port view-name property-:value

3. If necessary, restart the instance of Directory Proxy Server for the changes to take effect.

   For information about restarting Directory Proxy Server, see To Restart Directory Proxy Server.

To Configure Custom Distribution Algorithm

Custom distribution algorithm can be configured for all types of data views, that is, ldap-data-view, jdbc-data-view, ldif-data-view, and join-data-view. In the following procedure the algorithm is set only for ldap-data-view.

1. Set the extension-jar-file-url property to contain the path of the Java Archive (JAR) file containing your distribution algorithm class.

   $ dpconf set-server-prop -h host -p port extension-jar-file-url:jar file path

   The jar file path can be replaced with a valid JAR file path such as file:/expt/dps/custom_plugin/myjar.jar.

2. Before you configure custom-distribution-algorithm, set distribution-algorithm to none.

   $ dpconf set-ldap-data-view-prop view name distribution-algorithm:none

3. Set the custom-distribution-algorithm property to your custom distribution algorithm class.

   $ dpconf set-ldap-data-view-prop view name custom-distribution-algorithm:PackageName.AlgoClassName

Renaming Attributes and DNs

Each entry in a directory is identified by a DN and a set of attributes and their values. Often, the DNs and the attributes defined on the client side do not map to the DNs and the attributes defined on the server side. Data views can be defined to rename DNs and attributes. When a client makes a request, the DNs and attributes are renamed to match the server side. When the result is returned to a client, the DNs and attributes are changed back to match the client side.

For information about attribute renaming and DN renaming, see Attribute Renaming and DN Renaming in Sun Java System Directory Server Enterprise Edition 6.1 Reference. For information about how to rename attributes and DNs, see the following procedures:

To Configure Attribute Renaming

You can use DSCC to perform this task. For information, see Directory Service Control Center Interface and the DSCC online help.

1. Set one or more attr-name-mappings properties on the data view for which you want to configure attribute mapping.

   $ dpconf set-ldap-data-view-prop -h host -p port view-name \ attr-name-mappings:client-side-attribute-name#server-side-attribute-name [attr-name-mappings:client-side-attribute-name#server-side-attribute-name ...]

   For example, rename surname on the client side to sn on the server side.

   $ dpconf set-ldap-data-view-prop -h host1 -p 1389 myDataView \ attr-name-mappings:surname#sn

   To add an attribute mapping to an existing list of mappings, use this command:

   $ dpconf set-ldap-data-view-prop -h host -p port view-name \ attr-name-mappings+:client-side-attribute-name#server-side-attribute-name

   To remove an attribute mapping from an existing list of mappings, use this command:

   $ dpconf set-ldap-data-view-prop -h host -p port view-name \ attr-name-mappings-:client-side-attribute-name#server-side-attribute-name

To Configure DN Renaming

You can use DSCC to perform this task. For information, see Directory Service Control Center Interface and the DSCC online help.

1. View the base-dn property and the DN mapping properties of the data view for which you want to rename DNs.

   $ dpconf get-ldap-data-view-prop -h host -p port view-name base-dn \ dn-mapping-source-base-dn dn-mapping-attrs

   The properties have the following meanings:

   • base-dn is the DN of the subtree on the client side, which is equivalent to the base DN of the data view.

   • dn-mapping-source-base-dn is the DN of the subtree on the server side.

   • dn-mapping-attrs defines a list of attributes that contain DNs of entries.

   For example, the data view for the dc=example,dc=com database on the client side has the following values when DN renaming is not defined:

   $ dpconf get-ldap-data-view-prop myDataView base-dn \ dn-mapping-source-base-dn dn-mapping-attrs base-dn : dc=example,dc=com dn-mapping-attrs : none dn-mapping-source-base-dn : none

2. Map a DN on the client side to a DN on the server side.

   $ dpconf set-ldap-data-view-prop -h host -p port view-name \ dn-mapping-source-base-dn:server-side-dn

   For example, map the dc=example,dc=com database on the client side to dc=example,dc=org on the server side.

   $ dpconf set-ldap-data-view-prop -h host1 -p 1389 myDataView \ dn-mapping-source-base-dn:dc=example,dc=org

3. Rename attributes in the portion of the DIT that is affected by Step 2, if those attributes contain DNs.

   $ dpconf set-ldap-data-view-prop -h host -p port view-name \ dn-mapping-attrs:attribute-name [dn-mapping-attrs:attribute-name ...]

   For example, if the group attribute contains DNs in the namespace affected by the rename operation in Step 2, rename the attribute as follows:

   $ dpconf set-ldap-data-view-prop -h host1 -p 1389 myDataView dn-mapping-attrs:group

   To add a DN mapping to an existing list of mappings, use this command:

   $ dpconf set-ldap-data-view-prop -h host -p port view-name dn-mapping-attrs+:attribute-name

   To remove a DN mapping from an existing list of mappings, use this command:

   $ dpconf set-ldap-data-view-prop -h host -p port view-name dn-mapping-attrs-:attribute-name

4. View the base-dn property and the DN mapping properties of the data view for which you have renamed DNs.

   $ dpconf get-ldap-data-view-prop -h host -p port view-name base-dn \ dn-mapping-source-base-dn dn-mapping-attrs

   For example, the data view for the dc=example,dc=com database on the client side has the following values after DN renaming:

   $ dpconf get-ldap-data-view-prop -h host1 -p 1389 myDataView base-dn \ dn-mapping-source-base-dn dn-mapping-attrs base-dn : dc=example,dc=com dn-mapping-attrs : group dn-mapping-source-base-dn : dc=example,dc=org

Configuring excluded-subtrees and alternate-search-base-dn

When a subordinate data view is created, Directory Proxy Server automatically excludes the subordinate data view from the superior data view. When a request targets the subordinate data view, the request is sent to the subordinate data view, not to the superior data view.

When an alternate search base is specified in a subordinate data view, search operations targeted at the superior data view are also performed in the subordinate data view.

By default, Directory Proxy Server automatically configures the excluded-subtrees and alternate-search-base-dn properties. The following procedure describes how to configure these properties manually.

To Manually Configure the excluded-subtrees and alternate-search-base-dn Properties

You can use DSCC to perform this task. For information, see Directory Service Control Center Interface and the DSCC online help.

1. Configure Directory Proxy Server to manually route requests.

   $ dpconf set-server-prop -h host -p port data-view-automatic-routing-mode:manual

   When data-view-automatic-routing-mode is manual, Directory Proxy Server does not generate the excluded-subtrees and alternate-search-base-dn properties. You must set the values of these properties manually. The values that you set here are not checked by Directory Proxy Server. Be aware that setting these values incorrectly can break the administration path.

   Alternatively, configure Directory Proxy Server to partially route requests manually.

   $ dpconf set-server-prop -h host -p port data-view-automatic-routing-mode:limited

   When data-view-automatic-routing-mode is limited, Directory Proxy Server does not generate the excluded-subtrees and alternate-search-base-dn properties. However, Directory Proxy Server does check that the values set here do not conflict with the administration path.

2. Configure the view exclusion base.

   $ dpconf set-ldap-data-view-prop -h host -p port view-name excluded-subtrees:suffix-DN

   The view exclusion base determines branches of the DIT whose entries are not exposed by the data view.

3. Configure the alternate search base.

   $ dpconf set-ldap-data-view-prop -h host -p port view-name \ alternate-search-base-dn:search-base-DN

   The alternate search base determines other branches of the DIT in which entries belonging to this data view may be located. The base DN is defined by default as an alternate search base in all data views.

Creating and Configuring Data Views for Example Use Cases

This section contains the following information about data views and how to create and configure them:

• Default Data View

• Data Views That Route All Requests, Irrespective of the Target DN of the Request

• Data Views That Route Requests When a List of Subtrees Is Stored on Multiple, Data-Equivalent Data Sources

• Data Views That Provide a Single Point of Access When Different Subtrees Are Stored in Different Data Sources

• Data Views That Provide a Single Point of Access When Different Parts of a Subtree Are Stored in Different Data Sources

• Data Views That Provide a Single Point of Access When Superior and Subordinate Subtrees Are Stored in Different Data Sources

• Data Views With Hierarchy and a Distribution Algorithm

The examples in this section assume that the connection handler allows all client connections to be processed by Directory Proxy Server.

Default Data View

If you create a data view without configuring any of the properties, your data view has the following configuration:

alternate-search-base-dn                    :  ""
alternate-search-base-dn                    :  base-DN
attr-name-mappings                          :  none
base-dn                                     :  suffix-DN
contains-shared-entries                     :  -
description                                 :  -
distribution-algorithm                      :  -
dn-join-rule                                :  -
dn-mapping-attrs                            :  none
dn-mapping-source-base-dn                   :  none
excluded-subtrees                           :  -
filter-join-rule                            :  -
is-enabled                                  :  true
is-read-only                                :  false
is-routable                                 :  true
ldap-data-source-pool                       :  pool-name
lexicographic-attrs                         :  all
lexicographic-lower-bound                   :  none
lexicographic-upper-bound                   :  none
non-viewable-attr                           :  -
non-writable-attr                           :  -
numeric-attrs                               :  all
numeric-default-data-view                   :  false
numeric-lower-bound                         :  none
numeric-upper-bound                         :  none
pattern-matching-base-object-search-filter  :  all
pattern-matching-dn-regular-expression      :  all
pattern-matching-one-level-search-filter    :  all
pattern-matching-subtree-search-filter      :  all
process-bind                                :  -
replication-role                            :  master
viewable-attr                               :  all except non-viewable-attr
writable-attr                               :  all except non-writable-attr

Data Views That Route All Requests, Irrespective of the Target DN of the Request

This section shows the configuration of a data view that routes all requests to a data source pool, irrespective of the target DN of the request. This data view is called the root data view. The root data view is created by default when an instance of Directory Proxy Server is created. For information about the root data view, see Data Views to Route All Requests, Irrespective of the Target DN of the Request in Sun Java System Directory Server Enterprise Edition 6.1 Reference.

The root data view has the following configuration:

alternate-search-base-dn                    :  -
attr-name-mappings                         :  none
base-dn                                    :  ""
contains-shared-entries                    :  -
description                                :  Automatically-generated data view 
                                              able to route client operations 
                                              independently of the operation base dn
distribution-algorithm                     :  -
dn-join-rule                               :  -
dn-mapping-attrs                           :  none
dn-mapping-source-base-dn                  :  none
excluded-subtrees                          :  ""
excluded-subtrees                          :  cn=config
excluded-subtrees                          :  cn=monitor
excluded-subtrees                          :  cn=proxy manager
excluded-subtrees                          :  cn=virtual access controls
excluded-subtrees                          :  dc=example,dc=com
filter-join-rule                           :  -
is-enabled                                 :  true
is-read-only                               :  false
is-routable                                :  true
ldap-data-source-pool                      :  defaultDataSourcePool
lexicographic-attrs                        :  all
lexicographic-lower-bound                  :  none
lexicographic-upper-bound                  :  none
non-viewable-attr                          :  -
non-writable-attr                          :  -
numeric-attrs                              :  all
numeric-default-data-view                  :  false
numeric-lower-bound                        :  none
numeric-upper-bound                        :  none
pattern-matching-base-object-search-filter :  all
pattern-matching-dn-regular-expression     :  all
pattern-matching-one-level-search-filter   :  all
pattern-matching-subtree-search-filter     :  all
process-bind                               :  -
replication-role                           :  master
viewable-attr                              :  all except non-viewable-attr
writable-attr                              :  all except non-writable-attr

Data Views That Route Requests When a List of Subtrees Is Stored on Multiple, Data-Equivalent Data Sources

This section describes how to configure a data view that routes requests targeted at a list of subtrees to a set of data-equivalent data sources. For information about this type of deployment, see Data Views to Route Requests When a List of Subtrees Are Stored on Multiple, Data-Equivalent Data Sources in Sun Java System Directory Server Enterprise Edition 6.1 Reference.

The example in this section has multiple data sources that contain the same set of subtrees. The data sources are data-equivalent and are pooled into one data source pool for load balancing. A data view is configured for each subtree to expose that subtree to client requests. The following figure shows the sample deployment.

Figure 22–1 Sample Deployment That Routes Requests When a List of Subtrees Is Stored on Multiple, Data-Equivalent Data Sources

To Configure Data Views That Route Requests When a List of Subtrees Is Stored on Multiple, Data-Equivalent Data Sources

You can use DSCC to perform this task. For information, see Directory Service Control Center Interface and the DSCC online help.

1. Create a data source for each LDAP server as described in Creating and Configuring LDAP Data Sources.

2. Create a data source pool as described in Creating and Configuring LDAP Data Source Pools.

3. Attach the data sources to the data source pool as described in Attaching LDAP Data Sources to a Data Source Pool.

4. (Optional) Configure load balancing.

   For information, see Configuring Load Balancing.

5. Create a data view with a base DN at dc=example1,dc=com that refers to the data source pool.

   $ dpconf set-ldap-data-view-prop -h host1 -p 1389 dataview-1 \ base-dn:dc=example1,dc=com ldap-data-source-pool:data-source-pool-1

6. Create another data view with a base DN at dc=example2,dc=com that refers to the data source pool.

   $ dpconf set-ldap-data-view-prop -h host1 -p 1389 dataview-2 \ base-dn:dc=example2,dc=com ldap-data-source-pool:data-source-pool-1

   The other properties of the data views are the same as the default data view in Default Data View.

7. If necessary, restart the instance of Directory Proxy Server for the changes to take effect.

   For information about restarting Directory Proxy Server, see To Restart Directory Proxy Server.

Data Views That Provide a Single Point of Access When Different Subtrees Are Stored in Different Data Sources

This section describes how to configure a data view that provides a single point of access to different subtrees stored in multiple data sources. For information about this type of deployment, see Data Views to Provide a Single Point of Access When Different Subtrees Are Stored on Different Data Sources in Sun Java System Directory Server Enterprise Edition 6.1 Reference.

The example in this section contains a data view for each subtree. A data source pool is configured for each set of data-equivalent data sources. The following figure shows the example deployment.

Figure 22–2 Sample Deployment That Provides a Single Point of Access When Different Subtrees Are Stored on Different Data Sources

To Configure Data Views That Provide a Single Point of Access When Different Subtrees Are Stored on Different Data Sources

You can use DSCC to perform this task. For information, see Directory Service Control Center Interface and the DSCC online help.

1. Create a data source for each LDAP server as described in Creating and Configuring LDAP Data Sources.

2. Create two data source pools as described in Creating and Configuring LDAP Data Source Pools.

3. Attach the data sources that contain dc=example1,dc=com to data-source-pool-1, and the data sources that contain dc=example2,dc=com to data-source-pool-2, as described in Attaching LDAP Data Sources to a Data Source Pool.

4. (Optional) Configure load balancing.

   For information, see Configuring Load Balancing.

5. Create a data view with a base DN at dc=example1,dc=com that refers to data-source-pool-1.

   $ dpconf set-ldap-data-view-prop -h host1 -p 1389 dataview-1 \ base-dn:dc=example1,dc=com ldap-data-source-pool:data-source-pool-1

6. Create another data view with a base DN at dc=example2,dc=com that refers to data-source-pool-2.

   $ dpconf set-ldap-data-view-prop -h host1 -p 1389 dataview-2 \ base-dn:dc=example2,dc=com ldap-data-source-pool:data-source-pool-2

   The other properties of the data views are the same as the default data view in Default Data View.

7. If necessary, restart the instance of Directory Proxy Server for the changes to take effect.

   For information about restarting Directory Proxy Server, see To Restart Directory Proxy Server.

Data Views That Provide a Single Point of Access When Different Parts of a Subtree Are Stored in Different Data Sources

This section describes how to configure a data view that provides a single point of access to different parts of a subtree. This example contains two data views with the same base DN. A numeric distribution algorithm is used to separate entries into different data views. A data source pool is configured for each set of data-equivalent data sources. The following figure shows the example deployment.

For information about this type of deployment, see Data Views to Route Requests When Different Parts of a Subtree Are Stored in Different Data Sources in Sun Java System Directory Server Enterprise Edition 6.1 Reference.

Figure 22–3 Sample Deployment That Provides a Single Point of Access When Different Parts of a Subtree Are Stored in Different Data Sources

To Configure Data Views That Provide a Single Point of Access When Different Parts of a Subtree Are Stored in Different Data Sources

You can use DSCC to perform this task. For information, see Directory Service Control Center Interface and the DSCC online help.

1. Create a data source for each LDAP server as described in Creating and Configuring LDAP Data Sources.

2. Create two data source pools as described in Creating and Configuring LDAP Data Source Pools.

3. Attach the data sources that contain one part of the subtree to data-source-pool-1, and the data sources that contain the other part of the subtree to data-source-pool-2, as described in Attaching LDAP Data Sources to a Data Source Pool.

4. (Optional) Configure load balancing.

   For information, see Configuring Load Balancing.

5. Create a data view with a distribution algorithm to select entries in ou=people,dc=example,dc=com with uid between 0 and 99, and configure the data view to direct requests to data-source-pool-1.

   $ dpconf set-ldap-data-view-prop -h host1 -p 1389 dataview-1 \ ldap-data-source-pool:data-source-pool-1 base-dn:ou=people,dc=example,dc=com \ distribution-algorithm :numeric numeric-attrs:uid numeric-lower-bound :0 \ numeric-upper-bound :99

6. Create another data view with a distribution algorithm to select entries in ou=people,dc=example,dc=com with uid between 100 and 199, and configure the data view to direct requests to data-source-pool-2.

   $ dpconf set-ldap-data-view-prop -h host1 -p 1389 dataview-2 \ ldap-data-source-pool:data-source-pool-2 base-dn:ou=people,dc=example,dc=com \ distribution-algorithm:numeric numeric-attrs:uid numeric-lower-bound:100 numeric-upper-bound :199

   The other properties of the data views are the same as the default data view in Default Data View.

7. If necessary, restart the instance of Directory Proxy Server for the changes to take effect.

   For information about restarting Directory Proxy Server, see To Restart Directory Proxy Server.

Data Views That Provide a Single Point of Access When Superior and Subordinate Subtrees Are Stored in Different Data Sources

This section describes how to configure a data view for a single point of access when a superior branch of a subtree is stored in a different data source to a subordinate branch. For information about this type of deployment, see Data Views to Route Requests When Superior and Subordinate Subtrees Are Stored in Different Data Sources in Sun Java System Directory Server Enterprise Edition 6.1 Reference.

The example in this section contains three data views. The base DN of data view 1 is superior to the base DN of data view 2 and the base DN of data view 3. Or, in other words, data source 2 and data source 3 contain subtrees that are subordinate to the subtree on data source 1. The following figure shows the example deployment.

Figure 22–4 Sample Deployment to Routes Requests When Superior and Subordinate Subtrees Are Stored in Different Data Sources

Directory Proxy Server automatically excludes a subordinate branch of a subtree from a data view when the subordinate branch is configured as the base DN of a separate data view.

To Configure Data Views That Provide a Single Point of Access When Superior and Subordinate Subtrees Are Stored in Different Data Sources

You can use DSCC to perform this task. For information, see Directory Service Control Center Interface and the DSCC online help.

1. Create a data source for each LDAP server as described in Creating and Configuring LDAP Data Sources.

2. Create three data source pools as described in Creating and Configuring LDAP Data Source Pools.

3. Attach the data sources to the data source pools by following the instructions in Attaching LDAP Data Sources to a Data Source Pool.

   • Attach the data sources that contain dc=example,dc=com to data-source-pool-1.

   • Attach the data sources that contain ou=computer,dc=example,dc=com to data-source-pool-2.

   • Attach the data sources that contain ou=people,dc=example,dc=com to data-source-pool-3.

4. (Optional) Configure load balancing.

   For information, see Configuring Load Balancing.

5. Create a data view with a base DN at dc=example,dc=com and a data source pool data-source-pool-1.

   $ dpconf create-ldap-data-view -h host1 -p 1389 dataview-1 \ data-source-pool-1 dc=example,dc=com

6. Create a data view with a base DN at ou=computer,dc=example,dc=com and a data source pool data-source-pool-2.

   $ dpconf create-ldap-data-view -h host1 -p 1389 dataview-2 \ data-source-pool-2 ou=computer,dc=example,dc=com

7. Create a data view with a base DN at ou=people,dc=example,dc=com and a data source pool data-source-pool-3.

   $ dpconf create-ldap-data-view -h host1 -p 1389 dataview-3 \ data-source-pool-3 ou=people,dc=example,dc=com

8. Verify that the subtrees ou=computer,dc=example, dc=com and ou=people,dc=example, dc=com have been excluded from dataview-1 by looking at the excluded-subtrees parameter.

   $ dpconf get-ldap-data-view-prop -h host1 -p 1389 dataview-1 excluded-subtrees

   The list of excluded subtrees is returned.

9. If necessary, restart the instance of Directory Proxy Server for the changes to take effect.

   For information about restarting Directory Proxy Server, see To Restart Directory Proxy Server.

Data Views With Hierarchy and a Distribution Algorithm

This section describes how to configure a data view to combine hierarchy with distribution algorithms. For information about this type of deployment, see Data Views With Hierarchy and a Distribution Algorithm in Sun Java System Directory Server Enterprise Edition 6.1 Reference.

The example in this section contains four data views. The base DN of data view 1 is superior to the base DNs of the other data views. Data view 3 and data view 4 have the same base DN, but a numeric distribution algorithm separates the entries into different data views.

Directory Proxy Server automatically excludes a subordinate branch of a subtree from a data view when the subordinate branch is configured as the base DN of a separate data view. A numeric distribution algorithm separates entries from the same subtree into different data views. A data source pool is configured for each set of data-equivalent data sources.

The following figure shows the example deployment.

Figure 22–5 Sample Data View With Hierarchy and a Distribution Algorithm

To Configure Data Views With Hierarchy and a Distribution Algorithm

You cannot use DSCC to perform this task. Use the command line, as described in this procedure.

1. Create a data source for each LDAP server as described in Creating and Configuring LDAP Data Sources.

2. Create four data source pools as described in Creating and Configuring LDAP Data Source Pools.

3. Attach the data sources to the data source pools by following the instructions in Attaching LDAP Data Sources to a Data Source Pool.

   • Attach the data sources that contain dc=example,dc=com to data-source-pool-1.

   • Attach the data sources that contain ou=computer,dc=example,dc=com to data-source-pool-2.

   • Attach the data sources that contain entries in ou=people,dc=example,dc=com with uid between 0 and 99 to data-source-pool-3.

   • Attach the data sources that contain entries in ou=people,dc=example,dc=com with uid between 100 and 199 to data-source-pool-4.

4. (Optional) Configure load balancing.

   For information, see Configuring Load Balancing.

5. Create a data view with a base DN at dc=example,dc=com, that refers to data-source-pool-1.

   $ dpconf create-ldap-data-view -h host1 -p 1389 dataview-1 \ data-source-pool-1 dc=example,dc=com

6. Create a data view with a base DN at ou=computer,dc=example,dc=com that refers to data-source-pool-2.

   $ dpconf create-ldap-data-view -h host1 -p 1389 dataview-2 \ data-source-pool-2 ou=computer,dc=example,dc=com

7. Create a data view with a base DN at ou=people,dc=example,dc=com that refers to data-source-pool-3. Configure a distribution algorithm on the data view to select entries with uid between 0 and 99.

   $ dpconf create-ldap-data-view -h host1 -p 1389 dataview-3 \ data-source-pool-3 ou=people,dc=example,dc=com $ dpconf set-ldap-data-view-prop dataview-3 distribution-algorithm:numeric \ numeric-attrs:uid numeric-lower-bound:0 numeric-upper-bound:99

8. Create a data view with a base DN at ou=people,dc=example,dc=com that refers to data-source-pool-4, and configure a distribution algorithm on the data view to select entries with uid between 100 and 199.

   $ dpconf create-ldap-data-view -h host1 -p 1389 dataview-4 \ data-source-pool-4 ou=people,dc=example,dc=com $ dpconf set-ldap-data-view-prop dataview-4 distribution-algorithm:numeric \ numeric-attrs:uid numeric-lower-bound:100 numeric-upper-bound:199

9. Verify that the subtrees ou=computer,dc=example, dc=com and ou=people,dc=example, dc=com have been excluded from dataview-1 by looking at the excluded-subtrees parameter.

   $ dpconf get-ldap-data-view-prop -h host1 -p 1389 dataview-1 excluded-subtrees

   The list of excluded subtrees is returned.

10. Restart the instance of Directory Proxy Server for the changes to take effect.

    For information about restarting Directory Proxy Server, see To Restart Directory Proxy Server.