Skip Navigation Links | |
Exit Print View | |
Oracle Directory Server Enterprise Edition Administration Guide 11g Release 1 (11.1.1.5.0) |
Part I Directory Server Administration
2. Directory Server Instances and Suffixes
3. Directory Server Configuration
6. Directory Server Access Control
7. Directory Server Password Policy
8. Directory Server Backup and Restore
9. Directory Server Groups, Roles, and CoS
10. Directory Server Replication
13. Directory Server Attribute Value Uniqueness
15. Directory Server Monitoring
Part II Directory Proxy Server Administration
16. Directory Proxy Server Tools
17. Directory Proxy Server Instances
Creating and Configuring LDAP Data Sources
To Configure an LDAP Data Source
Creating and Configuring LDAP Data Source Pools
To Create an LDAP Data Source Pool
To Configure an LDAP Data Source Pool
Attaching LDAP Data Sources to a Data Source Pool
Accessing Configuration Entries for a Directory Server by Using Directory Proxy Server
To Access the Configuration Entries of a Directory Server by Using Directory Proxy Server
To Configure Attribute Renaming
Configuring View Exclusion Base and Alternate Search Base
To Manually Configure the excluded-subtrees and alternate-search-base-dn Properties
Creating and Configuring Data Views for Example Use Cases
Data Views That Route All Requests, Irrespective of the Target DN of the Request
19. Directory Proxy Server Certificates
20. Directory Proxy Server Load Balancing and Client Affinity
21. Directory Proxy Server Distribution
22. Directory Proxy Server Virtualization
23. Virtual Data Transformations
24. Connections Between Directory Proxy Server and Back-End LDAP Servers
25. Connections Between Clients and Directory Proxy Server
26. Directory Proxy Server Client Authentication
27. Directory Proxy Server Logging
28. Directory Proxy Server Monitoring and Alerts
Part III Directory Service Control Center Administration
Creating an LDAP data view includes the following steps:
This section describes how to use the dpconf command to create and configure LDAP data sources. For reference information about these topics, see LDAP Data Sources in Oracle Directory Server Enterprise Edition Reference.
For information about how to create and configure LDAP data sources, see the following procedures.
You can use DSCC to perform this task. For information, see Directory Service Control Center Interface and the DSCC online help.
$ dpconf create-ldap-data-source -h host -p port [-s] source-name host:port
In this command, source-name is a name that you assign to the new data source. host and port refer to the host and port on which the LDAP server is running. Note that the data source does not use SSL by default. Use -s to enable to specify a secure port.
If the host is specified by an IP V6 address, you need to use the IP V6 reference when you create the data source. For example, if Directory Proxy Server will bind to a host with the IP V6 address fe80::209:3dff:fe00:8c93 on port 2389, use the following command to create the data source:
$ dpconf create-ldap-data-source -h host1 -p 1389 ipv6-host \ [fe80::209:3dff:fe00:8c93]:2389
If you use the console to create the data source, you must specify the actual IP V6 address (without the square brackets).
For information about how to modify the properties of an LDAP data source, see To Configure an LDAP Data Source.
$ dpconf list-ldap-data-sources -h host -p port
The following procedure shows how to display the properties of an LDAP data source and how to set the properties that you require to change. The procedure shows the commands using which any of the properties of the LDAP data source can be changed. It also shows how to get the detailed information of a property, which helps you to set that property.
You can use DSCC to perform this task. For information, see Directory Service Control Center Interface and the DSCC online help.
$ dpconf get-ldap-data-source-prop -h host -p port \ [-M unit] [-Z unit] source-name [property...]
In this command, -M and -Z refer to the units in which you want data to be displayed. The M option specifies the unit of time. The value for -M can be M, w, d, h, m, s, or ms, to represent months, weeks, days, hours, minutes, seconds, or milliseconds. The -Z option specifies the data size unit. The value for -Z can be T, G, M, k, or b, to represent Terabytes, Gigabytes, Megabytes, kilobytes, or bytes.
If you do not specify a property, all properties are displayed. The default properties of an LDAP data source are as follows:
bind-dn : - bind-pwd : - client-cred-mode : use-client-identity connect-timeout : 10s description : - down-monitoring-interval : inherited is-enabled : false is-read-only : true ldap-address : host ldap-port : port ldaps-port : ldaps monitoring-bind-timeout : 5s monitoring-entry-dn : "" monitoring-entry-timeout : 5s monitoring-inactivity-timeout : 2m monitoring-interval : 30s monitoring-mode : reactive monitoring-retry-count : 3 monitoring-search-filter : (|(objectClass=*)(objectClass=ldapSubEntry)) num-bind-incr : 10 num-bind-init : 10 num-bind-limit : 1024 num-read-incr : 10 num-read-init : 10 num-read-limit : 1024 num-write-incr : 10 num-write-init : 10 num-write-limit : 1024 proxied-auth-check-timeout : 1.8s proxied-auth-use-v1 : false ssl-policy : never use-read-connections-for-writes : false use-tcp-keep-alive : true use-tcp-no-delay : true
$ dpconf set-ldap-data-source-prop -h host -p port source-name is-enabled:true
$ dpconf set-ldap-data-source-prop -h host -p port source-name property:value
For example, if you want to modify entries on a data source, configure the data source to allow write operations.
$ dpconf set-ldap-data-source-prop -h host -p port source-name is-read-only:false
To use a read connection to process write operation when all the write connections are busy, run the following command. The vice-versa is also true.
dpconf set-ldap-data-source-prop -h host -p port source-name \ use-read-connections-for-writes:true
To find information about a property used in a subcommand, run this command:
$ dpconf help-properties ldap-data-source property
For example, to find information about the is-read-only property, run this command:
dpconf help-properties ldap-data-source is-read-only
To list the key properties for data sources, use the verbose option -v with the list-ldap-data-sources subcommand.
$ dpconf list-ldap-data-sources -v Name is-enabled ldap-address ldap-port ldaps-port description ----------- ---------- ------------ --------- ---------- ----------- datasource0 true myHost myPort ldaps - datasource1 true myHost myPort ldaps -
For information about restarting Directory Proxy Server, see To Restart Directory Proxy Server. For a list of configuration changes that require a server restart, see Configuration Changes Requiring Server Restart.
This section describes how to use the dpconf command to create and configure LDAP data source pools. For reference information about these topics, see LDAP Data Sources in Oracle Directory Server Enterprise Edition Reference.
For information about how to create and configure data source pools, see the following procedures:
You can use DSCC to perform this task. For information, see Directory Service Control Center Interface and the DSCC online help.
$ dpconf create-ldap-data-source-pool -h host -p port pool-name
Additional data source pools can be specified after the first pool-name. For information about how to modify the properties of a data source pool, see To Configure an LDAP Data Source Pool.
$ dpconf list-ldap-data-source-pools -h host -p port
You can use DSCC to perform this task. For information, see Directory Service Control Center Interface and the DSCC online help.
$ dpconf get-ldap-data-source-pool-prop -h host -p port \ [-M unit] [-Z unit] pool-name [property...]
In this command, -M and -Z refer to the units in which you want data to be displayed. The M option specifies the unit of time. The value for -M can be M, w, d, h, m, s, or ms, to represent months, weeks, days, hours, minutes, seconds, or milliseconds. The -Z option specifies the data size unit. The value for -Z can be T, G, M, k, or b, to represent Terabytes, Gigabytes, Megabytes, kilobytes, or bytes.
If you do not specify a property, all properties are displayed. The default properties of an LDAP data source pool are as follows:
client-affinity-bind-dn-filters : connection client-affinity-criteria : connection client-affinity-ip-address-filters : any client-affinity-policy : write-affinity-after-write client-affinity-timeout : 20s description : Example data source pool enable-client-affinity : false load-balancing-algorithm : proportional minimum-total-weight : 100 proportion : 100 sample-size : 100
$ dpconf set-ldap-data-source-pool-prop -h host -p port pool-name \ property:value
For information about how to configure the properties of a data source pool for load balancing and client affinity, see Chapter 20, Directory Proxy Server Load Balancing and Client Affinity.
A data source that is attached to a data source pool is called an attached data source. The properties of an attached data source determine the load balancing configuration of the data source pool. When you configure the weights of an attached data source, consider the weights of all of the attached data sources in a data source pool. Ensure that the weights work together as required. For information about how to configure weights for load balancing, see To Configure Weights for Load Balancing.
You can use DSCC to perform this task. For information, see Directory Service Control Center Interface and the DSCC online help.
$ dpconf attach-ldap-data-source -h host -p port pool-name \ source-name [source-name ...]
$ dpconf list-attached-ldap-data-sources -h host -p port -E pool-name
In this command, -E is optional, and modifies the display output to show one property value per line.
$ dpconf list-attached-ldap-data-sources -h host -p port -v pool-name
In this command, -v specifies verbose output. For example, view the properties of an example data source pool.
$ dpconf list-attached-ldap-data-sources -h host1 -p 1389 -v My-pool SRC_NAME add-weight bind-weight compare-weight ----------- ---------- ----------- -------------- datasource0 disabled disabled disabled datasource1 disabled disabled disabled delete-weight modify-dn-weight modify-weight search-weight ------------- ---------------- ------------- ------------- disabled disabled disabled disabled disabled disabled disabled disabled
$ dpconf get-attached-ldap-data-source-prop -h host -p port [-M unit] [-Z unit] \ pool-name source-name [property...]
In this command, -M and -Z refer to the units in which you want data to be displayed. The M option specifies the unit of time. The value for -M can be M, w, d, h, m, s, or ms, to represent months, weeks, days, hours, minutes, seconds, or milliseconds. The -Z option specifies the data size unit. The value for -Z can be T, G, M, k, or b, to represent Terabytes, Gigabytes, Megabytes, kilobytes, or bytes.
If you do not specify a property, all properties are displayed.
The properties of an attached data source define the weight for each type of operation in load balancing. The default weights of an attached data source are as follows:
add-weight : disabled bind-weight : disabled compare-weight : disabled delete-weight : disabled modify-dn-weight : disabled modify-weight : disabled search-weight : disabled
In the following example, all the properties are set to one. You can change the values of these properties as per your requirements. For information about how to configure weights of an attached data source for load balancing, see To Configure Weights for Load Balancing.
$ dpconf set-attached-ldap-data-source-prop -h host -p port \ pool-name source-name add-weight:1 $ dpconf set-attached-ldap-data-source-prop -h host -p port \ pool-name source-name bind-weight:1 $ dpconf set-attached-ldap-data-source-prop -h host -p port \ pool-name source-name compare-weight:1 $ dpconf set-attached-ldap-data-source-prop -h host -p port \ pool-name source-name delete-weight:1 $ dpconf set-attached-ldap-data-source-prop -h host -p port \ pool-name source-name modify-dn-weight:1 $ dpconf set-attached-ldap-data-source-prop -h host -p port \ pool-name source-name modify-weight:1 $ dpconf set-attached-ldap-data-source-prop -h host -p port \ pool-name source-name search-weight:1
For information about how to create and configure LDAP data views, see the following procedures:
You can use DSCC to perform this task. For information, see Directory Service Control Center Interface and the DSCC online help.
$ dpconf create-ldap-data-view -h host -p port view-name pool-name suffix-DN
For information about how to modify the properties of an LDAP data view, see To Configure an LDAP Data View.
$ dpconf list-ldap-data-views -h host -p port
You can use DSCC to perform this task. For information, see Directory Service Control Center Interface and the DSCC online help.
$ dpconf get-ldap-data-view-prop -h host -p port view-name
If you create a data view without configuring any of the properties, your data view has the following configuration:
alternate-search-base-dn : "" attr-name-mappings : none base-dn : suffix-DN contains-shared-entries : false custom-distribution-algorithm-class : none description : - distribution-algorithm : none dn-join-rule : none dn-mapping-attrs : none dn-mapping-source-base-dn : none excluded-subtrees : - filter-join-rule : none is-enabled : true is-read-only : false is-routable : true ldap-data-source-pool : pool-name lexicographic-attrs : all lexicographic-lower-bound : none lexicographic-upper-bound : none non-viewable-attr : none non-writable-attr : none numeric-attrs : all numeric-default-data-view : false numeric-lower-bound : none numeric-upper-bound : none pattern-matching-base-object-search-filter : all pattern-matching-base-dn-regular-expression : all pattern-matching-dn-regular-expression : all pattern-matching-one-level-search-filter : all pattern-matching-subtree-search-filter : all process-bind : - replication-role : master viewable-attr : all except non-viewable-attr writable-attr : all except non-writable-attr
Note - All users except the Proxy Manager see the cn=config and cn=monitor suffixes from the back-end server. By default, data from the back-end servers is not available to the Proxy Manager. The cn=config and cn=monitor subtrees that are available to the Proxy Manager are those of the proxy itself.
When you create a Directory Proxy Server instance, a connection handler for the Proxy Manager is created with an empty data view policy. If the Proxy Manager requires access to back-end data, you must add a data view to the data view policy of the Proxy Manager connection handler. On such a data view, the cn=config and cn=monitor subtrees are excluded by default.
$ dpconf set-ldap-data-view-prop -h host -p port view-name \ property:value [property:value ... ]
For example, to access the dc=example,dc=com subtree on a data source, specify dn-mapping-source-base-dn in the data view.
$ dpconf set-ldap-data-view-prop -h host1 -p 1389 myDataView \ dn-mapping-source-base-dn:dc=example,dc=com
To add a value to a multi-valued property, use this command:
$ dpconf set-ldap-data-view-prop -h host -p port view-name property+:value
To remove a value from a multi-valued property, use this command:
$ dpconf set-ldap-data-view-prop -h host -p port view-name property-:value
For information about restarting Directory Proxy Server, see To Restart Directory Proxy Server.