Chapter 3   Directory Server Configuration Settings for Meta-Directory


Once the iPlanet Directory Server and Meta-Directory software is installed, you must modify several Directory Server configuration settings to support the Meta-Directory system. This chapter describes the various configuration settings you need to make before you can begin using Meta-Directory.

Although the Meta-Directory console provides automatic support for making some of the configuration settings, this chapter explains in detail what is needed to configure Directory Server instances hosting Meta-Directory components, and it describes how to manually configure these settings.

The topics covered in this chapter are:

• Installing and Configuring Directory Server

• Enabling the Change Log

• Loading Meta-Directory Schema

• Adjusting Directory Server Plug-Ins

Installing and Configuring Directory Server

---

Directory Server must be installed and configured before you can run Meta-Directory. Detailed documentation for the iPlanet and Netscape Directory Servers, including installation and configuration instructions, can be found at the following iPlanet web site:

http://docs.iplanet.com/docs/manuals/directory.html

To support the Meta-Directory components, you must modify several Directory Server server settings. In particular, you must:

• Enable the change log

• Load the Meta-Directory schema

• Adjust the Directory Server plug-ins

  
  

  ---

  Note	The Meta-Directory console will automatically make several of these configuration settings when you create instances of the Meta-Directory components. However, the sections in this chapter explain the details of these configuration settings and show how to manually make the settings.

  ---

  
  

Directory Server Configuration Steps

The following steps describe what is needed to correctly install and configure iPlanet Directory Server so it can properly support Meta-Directory:

1. Install and start the Directory Server instance that will host the Meta-Directory configuration database (o=netscaperoot) or one of its components.

   See Chapter 2 "Planning the Meta-Directory System" for considerations on planning your Meta-Directory system setup.

2. Configure the Directory Server instance for use with Meta-Directory by performing the following tasks (these tasks are described in the sections that follow):
   1. Enable the change log.

   2. Load the Meta-Directory schema.

   3. Adjust the Directory Server plug-ins.

3. Shut down and restart the Directory Server instance.

   The Directory Server instance is now ready to support Meta-Directory components. Depending on your system setup, you might locate a meta view, or one or more connector views, on this instance. In addition, you will have a Directory Server instance supporting the Meta-Directory configuration files.

   The configuration for all iPlanet servers and components are stored in the directory tree under NETSITE_ROOT. This directory tree is configured when you install the Meta-Directory software.

4. Edit the configuration parameters of the user Directory Server instance to tune its performance.

   Once it is configured, you can fine tune the Directory Server settings to optimize its performance with Meta-Directory. Fine tuning Directory Server is described in Chapter 4 "Meta-Directory Performance Tuning."

Modifying Directory Server Settings

There are three ways in which you can edit the Directory Server configuration settings. The following list ranks these three methods from the easiest to the technically most difficult:

• Edit the configuration settings from the Directory Server console.

• Export the configuration settings to an LDIF file and modify the configuration settings using a text editor. Save the new configuration, reload the LDIF, and restart the server.

• Issue commands to modify the configuration database using the ldapmodify utility.

Enabling the Change Log

---

Enabling the Directory Server change log (o=changelog) allows Meta-Directory to participate in change notifications with other components. If it is not enabled, Meta-Directory will not function.

If the Directory Server change log is not enabled, Meta-Directory will display a dialog that prompts you to enable the change log when you create an instance of a Meta-Directory component. The procedures in the section describe how to manually enable this Directory Server feature.

Enabling the iPlanet Directory Server Change Log

iPlanet Directory Server version 5.0 implements two different change log mechanisms. One is used for multi-master replication and the other tracks updates made to the Directory Server database. The latter, the retro change log, must be enabled to support Meta-Directory processing.

In iPlanet Directory Server, the retro change log is implemented as a plug-in. To enable it, do the following:

1. Open the iPlanet Directory Server console.

2. Select the Configuration tab; the Configuration window appears.

3. In the navigation tree, expand the Plug-Ins node.

4. In the list of plug-ins, select the Retro Changelog Plug-In.

   The settings for the retro change log display in the right pane, as shown in Figure 3-1.

5. Check the Enable Plug-In box and choose Save to save the setting.

6. Once you enable the change log, you must restart the Directory Server for the settings to take effect.

Figure 3-1    Enabling the Change Log in iPlanet Directory Server

Enabling the Netscape Directory Server Change Log

To enable the change log for Netscape Directory Server version 4.1x:

1. Open the Directory Server console.

2. Select the Configuration tab; the Configuration window appears.

3. Select the Replication Agreements node in the navigation tree, then select the Supplier Settings tab in the right pane (shown in Figure 3-2).

4. Click the Use Default button to specify the default file path for the change log files.

5. Check the Max Changelog Records and Max Changelog Age settings so these parameters are set to "unlimited."

6. Once you enable the change log, you must restart the Directory Server for the settings to take effect.

Figure 3-2    Enabling the Change Log in Netscape Directory Server

Change Log Location

The location of the change log is important with regard to system performance. Since the change log can potentially produce many writes, you do not want activity to the change log to conflict with activity to other Directory Server databases. You might consider configuring Directory Server so that it creates and stores the change log in a disk partition that is different from where your LDAP databases are stored. Specifying a separate disk partition for the change log will reduce the seek time and disk latency of the disk(s) housing other LDAP databases.

In iPlanet Directory Server 5.0, the default path for the retro change log is related to the directory tree where the Directory Server instance is located: DS_Instance/db/changelog. You can modify this default path by editing the nsslapd-changelogdir attrubute under dn: cn=Retro Changelog Plugin,cn=plugins,cn=config.

Alternately, you can have Meta-Directory configure the path of the retro change log. If the retro change log is not enabled when you create an instance of a Meta-Directory component (such as the join engine), the Meta-Directory console will enable it for you and will prompt you for the directory where you want the log to be located.

In Directory Server 4.1x, you can set the change log location when you enable the feature.

Setting Write Permissions on Solaris Systems

On Solaris^TM systems, Directory Server is normally installed by a user with root privileges. Because of this, the directory containing Directory Server and all its subdirectories will contain a file permission mask of 755. If you create a special directory for the change log, you must ensure that Meta-Directory can write to this directory. It is recommended that the directory containing the change log has a file permission mask of 777. The following UNIX command will change the file permission of a directory to the desired 777:

chmod -R 777

Loading Meta-Directory Schema

---

To process Meta-Directory requests, Directory Server must recognize the extended schema (LDAP object classes and attributes) used by Meta-Directory components. Loading the Meta-Directory schema into Directory Server allows the Meta-Directory components to communicate with the Directory Server over LDAP.

Whenever you create an new instance of a Meta-Directory component, the Meta-Directory console will prompt you to load the extended schema into the Directory Server hosting the component.

The schema needs to be loaded into each Directory Server instance only once; after it is loaded, you need not reload it. However, because iPlanet Console cannot verify that the schema has been loaded, it will prompt you to do so, even if it has already been loaded.

Manually Loading the Meta-Directory Schema

The Meta-Directory schema is provided in the LDIF file md-schema.ldif, which is located in the NETSITE_ROOT/bin/join50/install/templates subdirectory of your Meta-Directory installation. You can manually add the Meta-Directory schema to the Directory Server configuration directory (NETSITE_ROOT\config) using either ldapmodify or through the Directory Server console.

Use the following command as an example if you want to add the Meta-Directory schema to a Directory Server instance using ldapmodify:

ldapmodify -h hostname -p 389 -D "cn=directory manager"
    -w password -a -c -v -f md-schema.ldif

The Meta-Directory schema contained in md-schema.ldif can also be imported using the Directory Server console. For more information on importing schema, refer to the iPlanet Directory Server Administrator's Guide.

---

Note

While possible, it is not necessary to add the Meta-Directory schema to an instance of Directory Server that does not host a Meta-Directory component. (For example, if you directly connect to a Directory Server instance to populate a connector view, that Directory Server instance does not host a Meta-Directory join engine or indirect connector component). If you do load the Meta-Directory schema into such an instance of Directory Server, you will get a string of error messages stating No Such Attribute ... Cannot delete. These messages do not indicate a problem—they are generated because the ldapmodify tool is attempting to delete the Meta-Directory attribute before it adds a new copy of the attribute.

---

Adjusting Write Permissions (Solaris Only)

On Solaris systems, the Directory Server instance may run with an identity different from its managing Administration Server. To grant Directory Server the permissions necessary to modify the Directory Server schema, issue the following commands from the UNIX command line:

% cd NETSITE_ROOT
% chmod ugo+w slapd-*/config/slapd-user_*.conf

Adjusting Directory Server Plug-Ins

---

There are two Directory Server plug-ins that need to be disabled in most Meta-Directory deployments: uid-uniqueness and referential integrity postoperation.

Setting uid-uniqueness Plug-In

If the data for the connector view and the meta view are in the same Directory Server instance, it may be required to turn off the Directory Server uid-uniqueness plug-in. You can turn off the plug-in from the Directory Server console.

The setting of the uid-uniqueness plug-in depends on the data you are hosting on a particular Directory Server instance. The uid-uniqueness plug-in applies a check to a particular suffix in a Directory Server instance. If you are flowing entries that have identical uid attributes in the same suffix, then you must turn off the uid-uniqueness plug-in in the Directory Server. Turning off the plug-in prevents errors arising from the check. Errors arising from a uid-uniqueness violation will be written to the join engine logs with an OBJECT_VIOLATION message.

For example, if you have the entry uid=x,ou=cv1 in a connector view containing the suffix o=siroe.com, and you flow the entry to the meta view, o=mv, the uid-uniqueness can remain enabled because the uid-uniqueness applies to a particular suffix and there is no conflict. You will be creating uid=x,o=mv for the meta-view entry and uid=x,o=iplanet for the connector view.

However, if the meta view has ou=mv1,o=siroe.com, then there will be a conflict with the connector view under the same o=siroe.com suffix: uid=x,ou=cv1,o=siroe.com. In this case, you must disable the uid-uniqueness plug-in if the data contains a uid attribute.

Disabling the uid-uniqueness Plug-In

1. Open the Directory Server console.

2. Choose the Configuration tab and select Plug-Ins in the navigation tree.

   The list of available Directory Server plug-ins displays in the navigation tree.

3. Select the uid-uniqueness plug-in.

   Details for the plug-in display in the right pane.

4. Deselect the Enable Plug-In check box.

5. Click Save and restart the Directory Server.

Setting the Referential Integrity Postoperation Plug-In

Normally, you will need to disable the Directory Server referential integrity plug-in in the Directory Server instance(s) that host Meta-Directory components.

When referential integrity is enabled, Directory Server will not write the changes that it makes to the change log. As a result, changes made to data cannot be detected by the Meta-Directory components and the Meta-Directory views will not be properly updated.

---

Caution

In cases where there are users and groups, you must watch out for a side effect when you disable the referential integrity plug-in. If you delete users belonging to a group (the user entries, as opposed to their group memberships), the group will still list the memberships of the users you have deleted. In these cases, you must manually delete the respective memberships from any groups listing the deleted users.

---

In very special circumstances, it is possible to keep the referential integrity plug-in enabled. Specifically, you can enable the referential integrity plug-in if all changes to data occur in one Meta-Directory view (for example, if all modifications are made in the meta view or if they are made in an external data source that populates a connector view). In this scenario, data modifications made in one view will be synchronized to the other Meta-Directory views when that view is refreshed. Here, data modifications do not rely on the change log to be synchronized to other views since all changes will flow from a single out to the other views. Note, however, that there may be a significant lag time between the refresh and the clean up done by the plug-in. Because of this, it is best to manually refresh the view after you make any data modifications.

Disabling the Referential Integrity Postoperation Plug-In

1. Open the Directory Server console.

2. Choose the Configuration tab and select Plug-Ins in the navigation tree.

   The list of available Directory Server plug-ins displays in the navigation tree.

3. Select the referential integrity postoperation plug-in.

   Details for the plug-in display in the right pane.

4. Deselect the Enable Plug-In check box.

5. Click Save and restart the Directory Server.