Oracle® Fusion Middleware

Release Notes for Oracle Directory Server Enterprise Edition

11g Release 1 (11.1.1.7.0)

E28975-02

April 2014

Oracle Fusion Middleware Release Notes for Oracle Directory Server Enterprise Edition 11g Release 1 (11.1.1.7.0)

E28975-02

Copyright © 2001, 2014, Oracle and/or its affiliates. All rights reserved.

Primary Author:  Gina Cariaga

This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited.

The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing.

If this is software or related documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable:

U.S. GOVERNMENT END USERS: Oracle programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, delivered to U.S. Government end users are "commercial computer software" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, use, duplication, disclosure, modification, and adaptation of the programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, shall be subject to license terms and license restrictions applicable to the programs. No other rights are granted to the U.S. Government.

This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications that may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate failsafe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications.

Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners.

Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group.

This software or hardware and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. Oracle Corporation and its affiliates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services.

Contents

List of Tables

Preface

- Who Should ReadThis Book

- The Oracle Fusion Middleware Documentation Set

- Related Reading

- Redistributable Files

- Default Paths and Command Locations

- Typographic Conventions

- Shell Prompts in Command Examples

- Symbol Conventions

- Documentation, Support, and Training

- Oracle Software Resources

- Documentation Accessibility

1 What's New in This Release

- 1.1 New Features and Changes in Directory Server

- 1.1.1 New Features in Directory Server

- 1.1.2 Behavioral Changes in Directory Server

- 1.2 New Features and Changes in Directory Proxy Server

- 1.3 New Features and Changes in Administrative Commands

- 1.3.1 New Administration Features

- 1.3.2 Changes in Administrative Commands

2 Compatibility Issues

- 2.1 Platform Support

- 2.1.1 System Virtualization Support

- 2.2 Software Support

- 2.2.1 Removed Software Components

- 2.2.2 Changes in the Directory Service Control Center

- 2.3 Additional Compatibility Notes

3 Installation Notes

- 3.1 Getting the Software

- 3.2 Hardware and Operating System Requirements

- 3.3 Software Dependency Requirements

- 3.3.1 Supported JDBC Data Sources

- 3.3.2 Directory Server Plug-in Requirements in a Firewall Environment

- 3.3.3 Directory Server Enterprise Edition Privileges

- 3.4 Schema Support for Oracle Fusion Applications

4 Directory Server Bugs Fixed and Known Problems

- 4.1 Directory Server Bugs Fixed in This Release

- 4.2 Known Directory Server Limitations

- 4.3 Known Directory Server Bugs

5 Directory Proxy Server Bugs Fixed and Known Problems

- 5.1 Directory Proxy Server Bugs Fixed in This Release

- 5.2 Known Directory Proxy Server Limitations

- 5.3 Known Directory Proxy Server Bugs

6 Directory Server Resource Kit Bugs Fixed and Known Problems

- 6.1 About the LDAP C-SDK for Oracle Directory Server Enterprise Edition

- 6.2 Bugs Fixed in Directory Server Resource Kit

- 6.3 Known Problems and Limitations in Directory Server Resource Kit

Index

List of Tables

- 4-1 Directory Server Bugs Fixed in This Release

- 5-1 Directory Proxy Server Bugs Fixed in This Release

Preface

These Release Notes for Oracle Directory Server Enterprise Edition contain the latest information available for Oracle Directory Server Enterprise Edition 11g Release 1 (11.1.1.7.0).

This Preface provides information about the following topics:

- Who Should ReadThis Book

- The Oracle Fusion Middleware Documentation Set

- Related Reading

- Redistributable Files

- Typographic Conventions

- Shell Prompts in Command Examples

- Symbol Conventions

- Documentation, Support, and Training

- Oracle Software Resources

- Documentation Accessibility

Who Should ReadThis Book

This book is intended for administrators and users who want to deploy Oracle Directory Server Enterprise Edition 11g Release 1 (11.1.1.7.0).

The Oracle Fusion Middleware Documentation Set

This documentation set explains how to use Oracle Fusion Middleware to evaluate, design, deploy, and administer directory services. In addition, it shows how to develop client applications for Directory Server Enterprise Edition. The Oracle Fusion Middleware Directory Server Enterprise Edition Documentation Library is available at http://docs.oracle.com/cd/E29127_01/index.htm.

The following table lists the documents that make up the Directory Server Enterprise Edition documentation set.

Document Title

Contents

Release Notes for
Oracle Directory Server Enterprise Edition

Contains the latest information about Directory Server Enterprise Edition, including known problems.

Evaluation Guide for
Oracle Directory Server Enterprise Edition

Introduces the key features of this release. Demonstrates how these features work and what they offer in the context of a deployment that you can implement on a single system.

Deployment Planning Guide for
Oracle Directory Server Enterprise Edition

Explains how to plan and design highly available, highly scalable directory services based on Directory Server Enterprise Edition. Presents the basic concepts and principles of deployment planning and design. Discusses the solution life cycle, and provides high-level examples and strategies to use when planning solutions based on Directory Server Enterprise Edition.

Installation Guide for
Oracle Directory Server Enterprise Edition

Explains how to install the Directory Server Enterprise Edition software. Shows how to configure the installed software and verify the configured software.

Upgrade and Migration Guide for
Oracle Directory Server Enterprise Edition

Provides instructions for upgrading versions 11.1.1.3, 7.x, and 6 installations, and instructions for migrating version 5.2 installations.

Administrator's Guide for
Oracle Directory Server Enterprise Edition

Provides command-line instructions for administering Directory Server Enterprise Edition.

For hints and instructions about using the Directory Service Control Center, DSCC, to administer Directory Server Enterprise Edition, see the online help provided in DSCC.

Reference for
Oracle Directory Server Enterprise Edition

Introduces technical and conceptual foundations of Directory Server Enterprise Edition. Describes its components, architecture, processes, and features.

Man Page Reference for
Oracle Directory Server Enterprise Edition

Describes the command-line tools, schema objects, and other public interfaces that are available through Directory Server Enterprise Edition. Individual sections of this document can be installed as online manual pages.

Developer's Guide for
Oracle Directory Server Enterprise Edition

Shows how to develop directory client applications with the tools and APIs that are provided as part of Directory Server Enterprise Edition.

Troubleshooting for
Oracle Directory Server Enterprise Edition Guide

Provides information for defining the scope of the problem, gathering data, and troubleshooting the problem areas by using various tools.

Release Notes for
Identity Synchronization for Windows 6.0

Provides the latest information for installing, migrating, and upgrading Identity Synchronization for Windows 6.0 SP1.

Deployment Planning Guide for
Identity Synchronization for Windows 6.0

Provides general guidelines and best practices for planning and deploying Identity Synchronization for Windows.

Installation and Configuration Guide for
Identity Synchronization for Windows 6.0

Describes how to install and configure Identity Synchronization for Windows.

For an introduction to Directory Server Enterprise Edition, review the following documents in the order in which they are listed in the following figure.

Related Reading

The SLAMD Distributed Load Generation Engine is a Java application that is designed to stress test and analyze the performance of network-based applications. This application was originally developed by Sun Microsystems, Inc. to benchmark and analyze the performance of LDAP directory servers. SLAMD is available as an open source application under the Sun Public License, an OSI-approved open source license. To obtain information about SLAMD, go to http://www.slamd.com/. SLAMD is also available as a java.net project. See https://slamd.dev.java.net/.

Java Naming and Directory Interface (JNDI) supports accessing the Directory Server using LDAP and DSML v2 from Java applications. For information about JNDI, see http://www.oracle.com/technetwork/java/jndi/index.html. The JNDI Tutorial contains detailed descriptions and examples of how to use JNDI. This tutorial is at http://download.oracle.com/javase/jndi/tutorial/.

Identity Synchronization for Windows uses Message Queue with a restricted license. Message Queue documentation is available at http://www.oracle.com/technetwork/indexes/documentation/index.html.

Identity Synchronization for Windows works with Microsoft Windows password policies.

- Information about password policies for Windows 2003, is available in the Microsoft documentation (http://technet.microsoft.com/en-us/windowsserver/default.aspx) online.

- Information about the Microsoft Certificate Services Enterprise Root certificate authority, is available in the Microsoft support documentation (http://support.microsoft.com/default.aspx?scid=kb;en-us;247078) online.

- Information about configuring LDAP over SSL on Microsoft systems, is available in the Microsoft support documentation (http://support.microsoft.com/default.aspx?scid=kb;en-us;321051) online.

Redistributable Files

Directory Server Enterprise Edition does not provide any files that you can redistribute.

Default Paths and Command Locations

This section explains the default paths used in documentation, and provides locations of commands on different operating systems and deployment types.

Default Paths

The table in this section describes the default paths that are used in this document. For complete descriptions of the files installed, see Chapter 1, Directory Server Enterprise Edition File Reference, in Reference for Oracle Directory Server Enterprise Edition.

Placeholder

Description

Default Value

install-path

Represents the base installation directory for Directory Server Enterprise Edition software.

When you install from a zip distribution using unzip, the install-path is the current-directory/dsee7.

instance-path

Represents the full path to an instance of Directory Server or Directory Proxy Server.

Documentation uses /local/dsInst/ for Directory Server and /local/dps/ for Directory Proxy Server.

No default path exists. Instance paths must nevertheless always be found on a local file system.

On Solaris systems, the /var directory is recommended:

serverroot

Represents the parent directory of the Identity Synchronization for Windows installation location

Depends on your installation. Note that the concept of a serverroot no longer exists for Directory Server and Directory Proxy Server.

isw-hostname

Represents the Identity Synchronization for Windows instance directory

Depends on your installation

/path/to/cert8.db

Represents the default path and file name of the client's certificate database for Identity Synchronization for Windows

current-working-dir/cert8.db

serverroot/isw-hostname/linebreaklogs/

Represents the default path to the Identity Synchronization for Windows local log files for the System Manager, each connector, and the Central Logger

Depends on your installation

serverroot/isw-hostname/linebreaklogs/central/

Represents the default path to the Identity Synchronization for Windows central log files

Depends on your installation

Command Locations

The table in this section provides locations for commands that are used in Directory Server Enterprise Edition documentation. To learn more about each of the commands, see the relevant man pages. See also "Sofware Layout for Directory Server Enterprise Edition" in the Reference for Oracle Directory Server Enterprise Edition.

Command

Zip Distribution

certutil

install-path/bin/certutil

dpadm

install-path/bin/dpadm

dpconf

install-path/bin/dpconf

dsadm

install-path/bin/dsadm

dsccagent

install-path/bin/agent

dsccmon

install-path/bin/dsccmon

dsccreg

install-path/bin/dsccreg

dsccsetup

install-path/bin/dsccsetup

dsconf

install-path/bin/dsconf

dsmig

install-path/bin/dsmig

dsutil

install-path/bin/dsutil

entrycmp

install-path/bin/entrycmp

fildif

install-path/bin/fildif

idsktune

At the root of the unzipped zip distribution

insync

install-path/bin/insync

ldapmodify

install-path/dsrk/bin/ldapmodify

ldapsearch

install-path/dsrk/bin/ldapsearch

repldisc

install-path/bin/repldisc

Typographic Conventions

The following table describes the typographic conventions that are used in this book.

Typeface

Meaning

Example

AaBbCc123

The names of commands, files, and directories, and onscreen computer output

Edit your .login file.

Use ls a to list all files.

machine_name% you have mail.

AaBbCc123

What you type, contrasted with onscreen computer output

machine_name% su

Password:

aabbcc123

Placeholder: replace with a real name or value

The command to remove a file is rm filename.

AaBbCc123

Book titles, new terms, and terms to be emphasized

Read Chapter 6 in the User's Guide.

A cache is a copy that is stored locally.

Do not save the file.

Note: Some emphasized items appear bold online.

Shell Prompts in Command Examples

The following table shows the default UNIX system prompt and superuser prompt for shells that are included in the Oracle Solaris OS. Note that the default system prompt that is displayed in command examples varies, depending on the Oracle Solaris release.

Shell

Prompt

Bash shell, Korn shell, and Bourne shell

$

Bash shell, Korn shell, and Bourne shell for superuser

#

C shell

machine_name%

C shell for superuser

machine_name#

Symbol Conventions

The following table explains symbols that might be used in this book.

Symbol

Description

Example

Meaning

[ ]

Contains optional arguments and command options.

ls [-l]

The -l option is not required.

{ | }

Contains a set of choices for a required command option.

-d {y|n}

The -d option requires that you use either the y argument or the n argument.

${ }

Indicates a variable reference.

${com.sun.javaRoot}

References the value of the com.sun.javaRoot variable.

-

Joins simultaneous multiple keystrokes.

Control-A

Press the Control key while you press the A key.

+

Joins consecutive multiple keystrokes.

Ctrl+A+N

Press the Control key, release it, and then press the subsequent keys.

>

Indicates menu item selection in a graphical user interface.

File > New > Templates

From the File menu, choose New. From the New submenu, choose Templates.

Documentation, Support, and Training

See the following web sites for additional resources:

- Documentation (http://www.oracle.com/technetwork/indexes/documentation/index.html)

- Support (http://www.oracle.com/us/support/systems/index.html)

- Training (http://education.oracle.com)

Oracle Software Resources

Oracle Technology Network (http://www.oracle.com/technetwork/index.html) offers a range of resources related to Oracle software:

- Discuss technical problems and solutions on the ODSEE Discussion Forum (http://forums.oracle.com/forums/forum.jspa?forumID=877) and the Directory Services blog (http://blogs.oracle.com/directoryservices/).

- See the latest announcements on the Directory Services blog (http://blogs.oracle.com/directoryservices/).

- Download ODSEE 11g Example Files (http://www.oracle.com/technetwork/middleware/id-mgmt/learnmore/odsee11113-examples-350399.zip).

Documentation Accessibility

For information about Oracle's commitment to accessibility, visit the Oracle Accessibility Program website at http://www.oracle.com/pls/topic/lookup?ctx=acc&id=docacc.

Access to Oracle Support

Oracle customers have access to electronic support through My Oracle Support. For information, visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=info or visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=trs if you are hearing impaired.

1 What's New in This Release

These release notes provide current information on the date they are published. If the English version of the release notes has a more recent publication date, it might be updated with more current information that is not provided in other language versions. Consult the English version of the release notes for the most current information.

This chapter contains the following sections:

- New Features and Changes in Directory Server

- New Features and Changes in Directory Proxy Server

- New Features and Changes in Administrative Commands

1.1 New Features and Changes in Directory Server

- New Features in Directory Server

- Behavioral Changes in Directory Server

1.1.1 New Features in Directory Server

Entry Cache Preloading

When you preload the entry cache, the server saves the entries in cache at shutdown, and then loads these entries at startup. This allows the server to start up with recently-used entries already in cache. Preloading the entry cache is useful for arriving at reproducible results when testing, and for measuring and analyzing potential optimizations.

For more information about entry cache preloading, see the Administrator's Guide for Oracle Directory Server Enterprise Edition

Automatic Entry Cache Sizing

By default, the entry cache is now completely managed by the server, depending upon the load. LDAP Client operations per seconds are monitored and the entry cache resized according to how many requests can be handled by the server. Some operations are inherently slower than others (groupsprocessing, for example). You may want to evaluate your load with the default settings, and then resize the entry cache manually if performance is inadequate.

For more information about entry cache sizing, see the following:

- Reference for Oracle Directory Server Enterprise Edition

- Administrator's Guide for Oracle Directory Server Enterprise Edition

New Ciphers for Attribute Encryption

The following ciphers for attribute encryption are new in this release:

- aes128 - AES 128 bit block cipher

- aes256 - AES 256 bit block cipher

- camellia128 - Camellia 128 bit block cipher

- camellia256 - Camellia 256 bit block cipher

For more information about configuring attribute encryption, see the Administrator's Guide for Oracle Directory Server Enterprise Edition

New Password Storage Schemes

SHA384 and SSHA384 password storage schemes are now supported options for the pwd-supported-storage-scheme property.

For more information, see the Man Page Reference for Oracle Directory Server Enterprise Edition

Automatic Entry Update for Password Policy Migration

The new convert-pwp-opattr-to-DS6 flag for the dsadm rewrite subcommand enables automatic entry updates during password policy migration. Moving from DS5-compatible-mode to DS6-mode occurs in two phases, which includes an intermediate stage in DS6-migration-mode.

For more information about password policy compatibility and migration, see the Administrator's Guide for Oracle Directory Server Enterprise Edition

Queue Backlog Monitoring Attribute

The attribute backlogsum describes total time in seconds spent by the worker threads from the moment an operation is received to the start of its processing. This parameter is not available on Windows.

For more information on Directory Server monitoring attributes, see the Reference for Oracle Directory Server Enterprise Edition

New Command Facilitates Backup and Restore

The new dsadm list-instance-dirs lists all directories comprising a Directory Server instance. You can then use its output as input for whatever archive utility you would like to use. This enables you to back up and to restore the service from scratch.

Log LDAP Controls in the Access Log

You can now enable control OIDs to be logged as part of LDAP operations and results in the access log. For more information about configuring Directory Server control OIDs in the access log, see the Administrator's Guide for Oracle Directory Server Enterprise Edition.

1.1.2 Behavioral Changes in Directory Server

- SNMP support has been revised. SNMP is now available only through the new SNMP Agent.

- The entry cn=snmp,cn=monitor now contains counters for all protocols. Searches must be run with scope base to get only this entry.

- Plugin signatures are now verified on Linux.

- The output for dsadm show-cert is now more compact. Use certutil to have more information on certificates.

- The dsmig subcommand now migrates only 5.2 instances; dsmig will not migrate a 6.x instance. See the Upgrade and Migration Guide for Oracle Directory Server Enterprise Edition.

- The dsconf reindex subcommand now puts the suffix in referral mode. Local data is not available until reindex finishes.

- When you click the Online Help button, you are directed to the webpage for the Oracle Directory Server Enteprise Edition Documentation Library.

- Directory Server chaining is deprecated and no longer ships with ODSEE. Chaining is not configurable through Directory Service Control Center, nor is chaining configurable through the new command line tools. Most deployments enabled by chaining are now enabled using features of Directory Proxy Server. For example, data distribution, global account lockout across an entire replication topology, and merging directory information trees can be done with Directory Proxy Server.

- Commands that were available in previous versions of Directory Server Enterprise Edition, but whose functions are now provided by other commands, are described in Command Line Changes in Upgrade and Migration Guide for Oracle Directory Server Enterprise Edition

- Commands that were removed from Directory Server Enterprise Edition, are described in Command Line Changes in Upgrade and Migration Guide for Oracle Directory Server Enterprise Edition.

1.2 New Features and Changes in Directory Proxy Server

Quiesce Mode

Before you stop Directory Proxy Server, or begin any Directory Proxy Server maintenance operation, you can reduce the risk of disrupting active server connections by enabling the quiesce mode. When quiesce mode is enabled, Directory Proxy Server immediately refuses client requests for new connections. As clients close their connections, Directory Proxy Server gradually transitions to an administrative state in which no open connections remain.

For information about enabling the quiesce mode, see the Administrator's Guide for Oracle Directory Server Enterprise Edition

AES Encryption Replaces 3DES Encryption

At startup, Directory Proxy Server automatically re-encrypts configuration data previously encrypted with 3DES. The configuration data is re-encrypted with the AES-128 algorithm for additional security. The key used for 3DES is kept, but the key is not used afterwards. A new key is generated for AES-128.

Crypt Option for Password Hashing

When a client modifies a password, Directory Proxy Server applies the encryption policy defined by the db-pwd-encryption property of the data view. In this release, the Crypt encryption policy is a new option on Solaris and Linux platforms.

For more information about password encryption and verification, see the Reference for Oracle Directory Server Enterprise Edition

Connection Tracking from Client to Back-end

This feature enables Directory Proxy Server to use in its access log the same identifier as Directory Server uses in its own access log. (Directory Proxy Server will still prefix the identifier with the data source's name). This simplifies the task of tracking the connections.

For more information about connection tracking, see the Reference for Oracle Directory Server Enterprise Edition.

Log LDAP Controls in the Access Log

You now can enable controls to be logged in all OPERATION and all SERVER_OP entries, both for requests and responses. By default, control OIDs are logged in the access log only in the OPERATION category for all operations other than extended, unbind and abandon.

For more information about configuring Directory Proxy Server control OIDs in the access log, see the Administrator's Guide for Oracle Directory Server Enterprise Edition

1.3 New Features and Changes in Administrative Commands

- New Administration Features

- Changes in Administrative Commands

1.3.1 New Administration Features

New DSCC Agent Enables Streamlined Login

The Cacao-based common container and Cacao agent no longer exist in ODSEE. So to start a Directory Server instance using the console, for example, you no longer provide an OS-based login to authenticate to Cacao in addition to the administrative username and password you provide to authenticate to DSCC. Instead, you provide only your DSCC administrative username and password. ODSEE then uses the new DSCC agent to delegate authentication to the DSCC registry.

See the following for more information about the DSCC agent:

- Deployment Planning Guide for Oracle Directory Server Enterprise Edition

- Oracle Directory Server Enterprise Edition Installation Guide

- Man Page Reference for Oracle Directory Server Enterprise Edition

New Administrative User

You can designate a specific user, whose entry is contained in the Directory Server, to act as a Directory Service Manager. A user who acts as a Directory Service Manager is called an Administrative User. The Administrative User can log in to DSCC using his or her own username or DN.

For more information about the Administrative User, see the Administrator's Guide for Oracle Directory Server Enterprise Edition

New SNMP Agent and Changes to the Monitoring Framework

The SNMP monitoring model is streamlined in this release, using a new SNMP agent. For more infomation about the new SNMP monitoring information flow, see the Reference for Oracle Directory Server Enterprise Edition

1.3.2 Changes in Administrative Commands

- The dsccagent command was added to the ODSEE command-line utility. The new command creates and configures the new DSCC agent. The dsccagent command has the following subcommands: dsccagent create, dsccagent delete, dsccagent start, dsccagent stop, dsccagent list-running-instances, dsccagent enable-service, dsccagent disable-service , dsccagent enable-snmp, and dsccagent disable-snmp. The subcommands enable-service and disable-service are available only on Solaris and Windows. On other operating systems, for example on Linux, contact your system administrator to develop scripts or configuration for the platform service management.
For more information about the dsccagent command, see the Man Page Reference for Oracle Directory Server Enterprise Edition

- You can now use the dsccreg command to register a new DSCC agent with the DSCC registry. The dsccreg command now includes the following subcommands: dsccreg add-agent, dsccreg list-agents, and dsccreg remove-agent.
For more information about dsccreg, see the Man Page Reference for Oracle Directory Server Enterprise Edition

2 Compatibility Issues

This chapter describes the features that have been deprecated or removed from Directory Server Enterprise Edition component products. This chapter also covers features that may be removed, and functionalities that may be deprecated in future releases of Directory Server Enterprise Edition.

This chapter covers the following topics:

- Platform Support

- Software Support

- Additional Compatibility Notes

Classifications of interface stability are provided per manual page entry in Man Page Reference for Oracle Directory Server Enterprise Edition.

2.1 Platform Support

For details of all the supported operating systems, see ODSEE Certification Matrix (http://www.oracle.com/technetwork/middleware/ias/downloads/fusion-certification-100350.html).

2.1.1 System Virtualization Support

System virtualization is a technology that enables multiple operating system (OS) instances to execute independently on shared hardware. Functionally, software deployed to an OS hosted in a virtualized environment is generally unaware that the underlying platform has been virtualized. Some testing has been performed on selected system virtualization and OS combinations to help validate that the products continue to function on properly sized and configured virtualized environments as they do on non-virtualized systems.

For this release, support is provided for any OS running on the Oracle VM technology, provided that the OS is already supported natively for the Directory Server Enterprise Edition 11g Release 1 (11.1.1.7.0) software. Certification is not provided for every combination of OS and hardware, and support relies on the underlying Oracle VM technology implementation. Production deployment of the Directory Server Enterprise Edition 11g Release 1 (11.1.1.7.0) software on the Oracle VM technology has not been extensively tested. Performance may be impacted when deploying Directory Server Enterprise Edition in a virtualized environment. ODSEE also supports Solaris Zones and Logical Domains (LDoms), which are part of Oracle VM technology.

For details about supported hardware platforms, operating systems and OS versions for this release of Directory Server Enterprise Edition, see the ODSEE Certification Matrix (http://www.oracle.com/technetwork/middleware/ias/downloads/fusion-certification-100350.html).

Note:

Installation of Identity Synchronization for Windows in a virtualized environment is not supported.

2.2 Software Support

Note the following changes in software support.

2.2.1 Removed Software Components

The following components are not provided in Directory Server Enterprise Edition 11g Release 1 (11.1.1.7.0).

- Java Enterprise System Monitoring Framework (JESMF) has been replaced by a new SNMP agent. For more information about SNMP monitoring, see the Reference for Oracle Directory Server Enterprise Edition.

- The Cacao-based common container and Cacao agent have been replaced by a new DSCC agent. For more information about the DSCC agent, see the Deployment Planning Guide for Oracle Directory Server Enterprise Edition

- Directory Editor was removed.

- Agent for Sun Cluster support was removed.

- Sun Java Web Console was removed.

2.2.2 Changes in the Directory Service Control Center

For detailed information about supported web browser and application servers, see the ODSEE Certification Matrix (http://www.oracle.com/technetwork/middleware/ias/downloads/fusion-certification-100350.html)

2.3 Additional Compatibility Notes

This section lists the features or commands that might be removed in a future release, and also mentions the features or commands that will be removed in the next release:

- SHA2 family password hashing can be used only for user data in a replicated topology when only ODSEE 11g R1 (11.1.1.7.0) servers are involved. Older servers are incapable of managing the password because the hashing algorithm is not recognized by older servers. SHA2 hashing can be used for local, non-replicated users such as cn=directory manager type accounts.
If SHA384 and SSHA384 are not used, the topology can include 11.1.1.5.0 servers.

- The Directory Proxy Server Proactive Monitoring feature now uses the simplified filter (objectClass=*).

- In the password policy, the DS5-compatible-mode interoperability mode is deprecated. In this version, you must use the DS6–mode interoperability mode.

- A few commands from Directory Server version 5.2 have been removed as described in Command Line Changes in Upgrade and Migration Guide for Oracle Directory Server Enterprise Edition.
The following legacy scripts have been replaced with the new commands:

Legacy Script

New Command

start-slapd

dsadm start

ldif2db

dsadm import

db2ldif

dsadm export

bak2db

dsadm restore

db2bak

dsadm archive

restart-slapd

dsadm restart

stop-slapd

dsadm stop

For more information, see Command Line Changes in Upgrade and Migration Guide for Oracle Directory Server Enterprise Edition.

- Before migrating a replicated server topology, review Chapter 7, Migrating a Replicated Topology, in Upgrade and Migration Guide for Oracle Directory Server Enterprise Edition.

- When you create a Directory Server instance in a replicated topology, password policy is configured initially backwards-compatible to assist with migrating the topology. After upgrading, you change the compatibility mode to enable richer password policy configuration. Directory Server manages the conversion. For more information, see Migrating a Deployment to ODSEE 11g Release 1 (11.1.1.7.0) in Administrator's Guide for Oracle Directory Server Enterprise Edition. In a future release, the backwards-compatible password policy configuration might be removed.

- When you create a Directory Server instance, support for the modify DN operation is disabled. After upgrading all the server instances in your replication topology, the modify DN operation can be replicated properly. At that point, you can enable support for the modify DN operation on each server instances. Use the dsconf set-server-prop moddn-enabled:on command for this purpose.
This feature is provided for version 5.2 compatibility.

- The db-path suffix property:
(dsconf set-suffix-prop suffix-name db-path:/new/directory and dsconf create-suffix --db-path)

is deprecated and might be removed in a future release.

Use the db-path server property to store all the suffixes in a different directory than the instance directory.

- Oracle Directory Server Enterprise Edition 11g Release 1 (11.1.1.7.0) includes a new bundle of Identity Synchronization for Windows. Identity Synchronization for Windows 6.0 SP1 is bundled with Oracle Directory Server Enterprise Edition.
Before upgrading Identity Synchronization for Windows, read the Release Notes for Identity Synchronization for Windows 6.0 Service Pack 1

- Directory Server Enterprise Edition 11g Release 1 (11.1.1.7.0) does not provide any changes to Directory Server Resource Kit.

- The LDAP utility manual pages on Sun Solaris systems do not document the version of the LDAP utilities ldapsearch, ldapmodify, ldapdelete, and ldapadd that are delivered with Directory Server Enterprise Edition. The utilities might no longer be delivered separately on Solaris systems, but instead might be integrated with the commands that are provided by the operating system in a future version. See Man Page Reference for Oracle Directory Server Enterprise Edition for the manual pages for the LDAP utilities.

- The idsktune component might be removed in a future release.

3 Installation Notes

This chapter provides information about downloading the Directory Server Enterprise Edition software, and lists the primary installation requirements.

This chapter covers the following topics:

- Getting the Software

- Hardware and Operating System Requirements

- Software Dependency Requirements

- Schema Support for Oracle Fusion Applications

3.1 Getting the Software

You can download the Oracle Fusion Middleware 11g Release 1 (11.1.1.7.0) software from the Oracle Software Delivery Cloud site as follows:

1. Point your browser to the Oracle Software Delivery Cloud site at http://edelivery.oracle.com.

2. Select the required language and click Continue.

3. Complete the Export Validation form and click Continue.

4. On the Media Pack Search page:

1. Select Oracle Fusion Middleware from the Select a Product Pack list.

2. Select the required platform and click Continue.

5. Select "Oracle Fusion Middleware 11g Media Pack" and click Continue.

Caution:

A common mistake is to select "Oracle Fusion Middleware Identity Management 11g Release 2."

Be sure to select "Oracle Fusion Middleware 11g Media Pack."

6. Select Oracle Directory Server Enterprise Edition 11g Release 1 (11.1.1.7.0) and click Download.

Directory Server Enterprise Edition 11g Release 1 (11.1.1.7.0) is available in a zip distribution for all supported platforms.

Note:

Identity Synchronization for Windows version 6.0 SP1 is bundled with Oracle Fusion Middleware 11g Release 1 (11.1.1.7.0).

Before you install Identity Synchronization for Windows version 6.0 SP1, you must readOracle Identity Synchronization for Windows 6 SP1 Release Notes.

3.2 Hardware and Operating System Requirements

For detailed information regarding hardware and operating system requirements, see the ODSEE Certification Matrix (http://www.oracle.com/technetwork/middleware/ias/downloads/fusion-certification-100350.html).

Note:

On Linux x64 platforms, ODSEE requires x86 libraries.

3.3 Software Dependency Requirements

The key software dependency requirements are as follows:

- Directory Server Enterprise Edition relies on the Network Security Services, NSS, layer for cryptographic algorithms. NSS has been validated to work with the Sun cryptographic framework provided on Solaris 10 systems, which supports cryptographic acceleration devices.

- Disable the pop-up blocker to make Directory Service Control Center work properly.

- Directory Proxy Server will work with any LDAPv3–compliant directory server, but has been tested only with the directory server component of Directory Server Enterprise Edition.

- To update the JRE as delivered by the Oracle Directory Server Enterprise Edition 11g Release 1 (11.1.1.7.0) software, you can replace the install-path/dsee7/jre directory with the jre directory from either a newer JDK or JRE distribution. Note that doing so will delete the jstack utility, and only newer JAVA updates than originally delivered are supported.
This procedure will allow you to apply JAVA patches without waiting for a new version of the product.

The following dependencies may also apply in your deployment:

- Supported JDBC Data Sources

- Directory Server Plug-in Requirements in a Firewall Environment

- Directory Server Enterprise Edition Privileges

3.3.1 Supported JDBC Data Sources

For virtualization, Directory Proxy Server has been validated with the following JDBC data sources, using the drivers mentioned below. Though Directory Proxy Server works with all the JDBC 3 compliant drivers.

JDBC Data Source

JDBC Driver

DB2 v9

IBMDB2 JDBC Universal Driver Architecture 2.10.27

Microsoft SQL Server 2005

sqljdbc.jar 1.2.2323.101

MySQL 5.x

MySQL-AB JDBC Driver mysql-connector-java-5.0.4

Oracle 10gDatabase

Oracle JDBC driver 10.2.0.2.0

JavaDB 10.5.3.0

ApacheDerbyNetwork Client JDBC Driver 10.5.3.0

3.3.2 Directory Server Plug-in Requirements in a Firewall Environment

Each Directory Server Enterprise Edition plug-in must be able to reach the Directory Server connector's server port, which was chosen when the connector was installed. Plug-ins that run in Directory Server Master replicas must be able to connect to Active Directory's LDAP, port 389, or LDAPS, port 636. The plug-ins that run in other Directory Server replicas must be able to reach the master Directory Server LDAP and LDAPS ports.

3.3.3 Directory Server Enterprise Edition Privileges

You can install Directory Server Enterprise Edition without special privileges. For more information, see the Installation Guide for Oracle Directory Server Enterprise Edition.

3.4 Schema Support for Oracle Fusion Applications

The ODSEE distribution includes the schema file FusionAppsSchema.ldif, but it is not loaded by default. Before you can use ODSEE with Oracle Fusion applications, you must import the schema definitions contained in FusionAppsSchema.ldif. For example:

# dsee7/dsrk/bin/ldapmodify -D cn=admin,cn=Administrators,cn=config -w - -f /path/to/FusionAppsSchema.ldif

For ODSEE 11g R1 (11.1.1.3) and earlier versions, apply the sunOneSchema.ldif bundled with Oracle Virtual Directory.

4 Directory Server Bugs Fixed and Known Problems

This chapter contains important, product-specific information available at the time of release of Directory Server 11g Release 1 (11.1.1.7.0).

This chapter contains the following sections:

- Directory Server Bugs Fixed in This Release

- Known Directory Server Limitations

- Known Directory Server Bugs

Note:

Bug information has been migrated from one database to another. If a bug number contains 8 digits, then the detailed bug information is currently stored in the Oracle bug database BugDB. If a bug number contains 7 digits, then the detailed bug information originated in the legacy Sun bug database Bugster. In these Release Notes, a bug number may be listed using the form BugDB#/Bugster#.

4.1 Directory Server Bugs Fixed in This Release

The following tables summarize all bug fixes contained in Directory Server Enterprise Edition 11g R1 (11.1.1.7.0).

Table 4-1 Directory Server Bugs Fixed in This Release

Bug ID

Description

14393413

Memory leak occurs when adding duplicate attribute values.

14377168

Replication should detect URL inconsistency in RUV.

14369830

If a search is performed for both attribute with and without subtype at the same time, the value with subtype is returned twice.

14347268

Exception is thrown when modifying a CoS template entry using DSCC.

14227880

Replication from one master to another master server halts.

14198000

Memory leak occurs using bin_ns-slapd.exe.

14147844

An ns-slapd crash occurs during LDIF import.

14090933

Performance issue with smartheap and multiple pools.

14074152

After configuring Directory Server as a Windows Service, you cannot stop the Directory Server instance or remove the Windows Service.

14056973

A double free error occurs when modifying a badly formed RDN.

14052999

Update Directory Server shared components.

13973308

An unexpected error occurs when using the Check Syntax button.

13918298

Using DSCC, an error message "Failure Count Reset" in Account Lockout is wrong.

13833118

When modifying a DN, a memory leak can occur if the moved entry has an entryID smaller than the new superior entry.

13824107

Minor memory leak during backup/restore task.

13795374

A memory leak may occur when you run bin_ns-slapd.exe using Oracle Directory Server Enterprise Edition versions 7.0 or 11.1.1.3 on a 64-bit Windows Server.

13599534

If an error occurs during online rewrite task creation, the task is not destroyed internally. The server, waiting for the task to end, hangs at shutdown.

13591464

When replication is not configured on a Directory Server, using the command dsconf rewrite -f purge-csn=on crashes the server.

13585561

Time Based Log Rotation does not work as expected.

13536842

During reindexing, if any attribute is encrypted, Error 4804, Error 4806, and Error 21256 occur.

13499849

If a moddn operation is attempted, but the server is configured to reject moddn operations, then a memory leak can occur.

13447459

Using Directory Server 11.1.1.3.0, a dramatic drop in performance occurs after a failed modrdn operation.

13413986

Directory Server should return referral during reindexing.

13390361

The log for an indexed search indicates notes=U.

13242112

Data of type OCTETSTRING is corrupted by DSCC.

13078242

Heap corruption in ns-slapd password storage plugin.

13064841

If you attempt to add an ACI using the "New ACI From Syntax..." button, when you click OK or click Check Syntax, you are redirected to a login page.

13044577

When a Directory Proxy Server instance is stopped using either the dpadm command or SMF service, DSCC shows the DPS status as "Degraded."

12972095

Migration from Directory Server 5.2 to ODSEE 11g fails on nsMatchingRule.

12904374

Identity Synchronization for Windows on-demand synchronization fails under specific mixed case host-FQDN configuration.

12859825

Directory Server crashes while attempting a backup. After the server crashes, you cannot restart the server.

12839666

Corrupted IP address is logged when connections are aborted.

12830963

Directory Server 11.1.1.3.0 does not start in read-only mode on SUSE Linux- 10 (X86_64).

12824002

When using dsmig config to migrate from Directory Server Enterprise Edition 5.2, the index configuration is not successfully migrated.

12751400

It is possible to modify an entry with a user whose password must be changed.

12708119

After being written with an invalid nsuniqueid, a database entry cannot be read.

12654448

Using the SASL bind GSSAPI, if there is a mismatch between authzid and authid, the bind is rejected.

12647512

Directory Server allows a poorly formed ldapmodify request to be processed.

12603625

Misleading error message is displayed in DSCC when max-age:unlimited is set.

12589178

Directory Server hangs after Error 20765.

12567769

The memberof plugin initialization searches can cause server to hang during shutdown.

12534890

Offline rewrite of a suffix does not use optional parameter.

12417570

Directory Server crashes due to replication stack issue.

12376213

Directory Server hangs while dsconf create-index is running.

12352171

Performance problem occurs on Directory Server running on HP 585 G5 and HP 580 G7 NUMA based hardware.

12336193

System crashes due to combination of ds-gather-filter-stats and base=one searches.

12310114

Improve re-indexing on production deployments to accommodate new attributes.

12309638

CoS fails to use the operational qualifier properly, so operational attributes are returned.

12307634

Directory Server instance registered as service does not stop properly upon Windows system shutdown.

12305811/7008961

The dsccmon command line output includes numerous but useless INFO messages making it difficult to read important information.

12302779/6993689

When adding a password policy to a sub suffix, if the DN uses a case different from the case used in suffix definitions, then the password policy is displayed twice.

12287748/6924135

DSCC displays incorrect information, "Operational Status : Index Modified - Initialization or Regeneration Required."

12284721/6908622

When running the insync command, a crash occurs if one or more upper-case character is used as a hostname of option -S.

12258927/6791392

When editing a default security certificate, the tooltip displays an invalid string.

12199602/6550038

Creating a replication suffix by copying the replication agreement from an existing suffix fails.

12170721/6445363

Password policy control OID is listed twice in the supported control attribute.

11886697

Command dsdconf reindex causes ns-slapd to crash if the database contains encrypted attributes AND if the database has been migrated from version 6.x or version 5.x.

4.2 Known Directory Server Limitations

This section lists known Directory Server limitations at the time of release.

Dtrace probes on Solaris 10 x64 may not work

A fix for this limitation is included in the Solaris 10 Update 11. (15699438/7022701)

Supported and unsupported filesystem types

UFS and ZFS are the recommended filesystem types for use with ODSEE on Solaris. LOFS is a supported filesystem for use with ODSEE on Solaris. However, if you use the LOFS filesystem, you may encounter performance issues. NFS and CIFS are not supported filesystems for use with ODSEE regardless of OS. (14605778)

Using SASL Authentication on Windows

If you use SASL authentication on Windows, enable starttls to avoid connection problems. (14556992)

Number of servers that can be managed using DSCC

The Directory Service Control Center (DSCC) enables centralized administration of Directory Server and Directory Proxy Server instances. The current version of DSCC has been tested successfully in an environment of 42 server instances, supporting most common configurations.

Proper Use of Entry Management Tab

The 'Entry Management' tab in DSCC is meant as a simple browser and editor. For advanced and regular browsing, editing, and monitoring of LDAP entries, use CLIs.

Do not change file permissions by hand.

Changes to file permissions for installed Directory Server Enterprise Edition product files can in some cases prevent the software from operating properly. Only change file permissions when following instructions in the product documentation, or following instructions from Oracle support.

To work around this limitation, install products and create server instances as a user having appropriate user and group permissions.

Do not replicate the cn=changelog suffix.

Although nothing prevents you from setting up replication for the cn=changelog suffix, doing so can interfere with replication. Do not replicate the cn=changelog suffix. The cn=changelog suffix is created by the retro changelog plug-in.

The wrong SASL library is loaded when LD_LIBRARY_PATH contains /usr/lib.

When LD_LIBRARY_PATH contains /usr/lib, the wrong SASL library is used, causing the dsadm command to fail after installation.

Use the LDAP replace operation to change cn=config attributes.

An LDAP modify operation on cn=config can only use the replace sub-operation. Any attempt to add or delete an attribute will be rejected with Error 53: DSA is unwilling to perform. While Directory Server 5 accepted adding or deleting an attribute or attribute value, the update was applied to the dse.ldif file without any value validation, and the DSA internal state was not updated until the DSA was stopped and started.

Note:

The cn=config configuration interface is deprecated. Where possible use the dsconf command instead.

To work around this limitation, the LDAP modify replace sub-operation can be substituted for the add or delete sub-operation. No loss in functionality occurs. Furthermore, the state of the DSA configuration is more predictable following the change.

On Windows systems, Directory Server does not allow Start TLS by default.

This issue affects server instances on Windows systems only. This issue is due to performance on Windows systems when Start TLS is used.

To work around this issue, consider using the -P option with the dsconf command to connect using the SSL port directly. Alternatively, if your network connection is already secured, consider using the -e option with the dsconf command. The option lets you connect to the standard port without requesting a secure connection.

Replication update vectors may reference retired servers.

After you remove a replicated Directory Server instance from a replication topology, replication update vectors can continue to maintain references to the instance. As a result, you might encounter referrals to instances that no longer exist.

On Windows systems, max-thread-per-connection-count is not useful.

The Directory Server configuration properties max-thread-per-connection-count and ds-polling-thread-count do not apply for Windows systems.

Changing index configurations on the fly

If you change an index configuration for an attribute, all searches that include that attribute as a filter are treated as not indexed. To ensure that searches including that attribute are properly processed, use the dsadm reindex or dsconf reindex commands to regenerate existing indexes every time you change an index configuration for an attribute. See Chapter 12, ODSEE Indexing, in Administrator's Guide for Oracle Directory Server Enterprise Edition for details.

4.3 Known Directory Server Bugs

This section lists the issues that are known at the time of the Directory Server 11g Release 1 (11.1.1.7.0).

14809053

A previously undocumented limitation on ACI evaluation during MODRDN rejects the operation when the ACIs specify a deny rule. See the Administrator's Guide for Oracle Directory Server Enterprise Edition for more information.

14596990

Using WebLogic 10.3.6, when you double-click on a server to select it in DSCC, you are abruptly logged out of the console.

14556992

On Windows 2008 only, sometimes SASL/DIGEST-MD5 binds fails with an ASN.1 error, after which the connection appears to be not closed.

14467092

On Solaris 11 SPARC or X64, and on recent updates of Solaris 10, sometimes connections cannot be established between the Java-based client application dsconf and the Directory Server.

This is due to unwanted interactions between the JDK7 that ships with ODSEE and some Solaris 11 operating system libraries. To avoid this, do not use the system's libraries.

As a workaround, you can do one of the following:

- In the file $INSTALL_DIR/dsee7/jre/lib/security/java.security, remove any sunpkcs11 related entries.

- Replace $INSTALL_DIR/dsee7/jre/lib/security/java.security with a modified version of the file that ships with the ODSEE:
$INSTALL_DIR/dsee7/resources/install/java.security.nosunpkcs11

14273816

When a DSCC registry is deleted, the registry information is not updated appropriately, and the registry information remains stored in the agent itself.

14010898

When attempting to deploy the DSCC WAR file on using Apache Tomcat 6.0.14, a Java exception occurs.

13717261

On Solaris 10 Update 10 and on Solaris 11 11.11, if the Directory Server instance is registered as an SMF service, you cannot start the server instance.

12967609

When replication is working correctly between a Directory Server 6.x master and a Directory Server 5.x consumer or master, the DSCC displays a false Operational Status "The destination suffix is not initialized." The destination suffix is actually initialized, and you can safely ignore the Perennial Status.

12967449

The replcheck command does not work with partial replication.

12305195 and 12305197/12302886

In the Japanese version of DSCC, when you click the Version button, the Version page does not display as designed. When you click the Help button, the Help page does not display as designed. In both instances, the title bar displays a question mark (?) instead of the proper page title.

12302886/6994121

If you use DSCC to modify one or more properties of an index attribute for a suffix, the data is actually updated in the backend, but the status is not updated in the suffix Indexes page as expected. Even clicking the Refresh button on the suffix Indexes page does not return the updated status.

To work around this issue, disconnect from DSCC, and then re-connect to DSCC. When you go to the suffix Indexes page, the status should be properly updated.

12300751/6982478

When attempting to view replication topology images in the DSCC, DSCC throws an error and indicates it cannot load the page.

To work around this issue, in the JVM options of the application server in which DSCC is deployed, apply the following:

-Djava.awt.headless=true

12297675/6966010

The command dsconf help-properties inverts the description for the fractional replication properties. The following output:

repl-fractional-exclude-attr ... Replicate only the specified set of attributes
repl-fractional-include-attr ... Do not replicate the specified set of attributes

should be as follows:

repl-fractional-exclude-attr ... Do not replicate the specified set of attributes
repl-fractional-include-attr ... Replicate only the specified set of attributes

12297154/6963820

When some race conditions occur on replicated operations, the retro-changlog might not reflect the correct order of changes. There is no workaround at this time.

12292262/2191561

The server may hang if a changelog trimming is ongoing while an online restore is started.

12282391/6898084

The dsconf command binds as anonymous first when an SSL port is used. This may prevent dsconf from working in deployments where anonymous binds are rejected by the server.

12281537/6894136

If you set the idle timeout to a very small value, for example, 2s on a server instance, DSCC might display connection errors and prevent some operations that take long time to complete (like rotating logs). Make sure you set the idle timeout to at least 10s or 20s, and adjust the idle timeout according to your network latency.

12277553/6874631

The uidObject objectclass is missing from the schema.

To work around this issue, add the following objectclass to the 00core.ldif file:

objectClasses: ( 1.3.6.1.1.3.1 NAME 'uidObject' SUP top AUXILIARY MUST uid X-ORIGIN 'RFC 4519')

12277549/6874624

An obsolete definition remains in the 28pilot.ldif file.

To work around this issue, add the following alias specification to the 28pilot.ldif file:

objectClasses: ( 0.9.2342.19200300.100.4.4 NAME ('newPilotPerson' 'pilotPerson') DESC <...>)

12272789/6853393

DSCC does not support host synonyms. When replicating the DSCC suffix, the host name in the replication agreement must match the host name in the DSCC registry.

12221093/6640755

In Windows, in the Korean locale, the dsadm start command does not display the nsslapd error log when ns-slapd fails to start.

12220200/6637242

After deploying the WAR file, the View Topology button does not always work. A Java exception sometimes occurs, which is based on org.apache.jsp.jsp.ReplicationTopology_jsp._jspService

12218303/6630924

The output of the dsadm show-*-log command is not correct if some lines in the log contain more than 1024 characters.

12218292/6630897

The output of the dsadm show-*-log l command does not include the correct lines. It can include the last lines of a previously rotated log.

12208166/6587801

Directory Service Control Center and the dsadm command from versions 6.1 or later do not display built-in CA certificates of Directory Server instances that were created with the dsadm command from version 6.0.

To workaround this issue:

Add the 64-bit module with 64-bit version of modutil:

$ /usr/sfw/bin/64/modutil -add "Root Certs 64bit" \
-libfile  /usr/lib/mps/64/libnssckbi.so -nocertdb \
-dbdir /instance-path/alias -dbprefix slapd- -secmod secmod.db

12204344/6571038

For servers registered in DSCC as listening on all interfaces (0.0.0.0), attempting to use dsconf to modify the listen-address of the servers results in DSCC errors.

To have an SSL port only and secure-listen-address setup with Directory Server Enterprise Edition, use this workaround:

1. Unregister the server from DSCC:

dsccreg remove-server /local/myserver

2. Disable the LDAP port:

dsconf set-server-prop ldap-port:disabled

3. Set up a secure-listen-address:

$ dsconf set-server-prop secure-listen-address:IPaddress

$ dsadm restart /local/myserver

4. Register the server using DSCC. In the Register Server wizard, specify the server's IP address. This operation cannot be undone.

12197665/6542857

When you use the Service Management Facility (SMF) on Solaris 10 to enable a server instance, the instance might not start when you reboot the system and return the following error:

svcadm: Instance "svc:/instance_path" is in maintenance state.

To work around this problem, use a local user to create Directory Server and Directory Proxy Server servers (that is, a user that is defined locally on the machine rather than an NIS user.)

12197180/6541040

When modifying the password policy using the Directory Service Control Center, attributes that have not changed may be unknowingly reset.

Using the Directory Service Control Center to manage the default password policy does not causes any error. However, using the Directory Service Control Center to manage specialized password policies can cause unchanged attributes to be reset.

12185018/6495004/

On Windows systems, Directory Server has been seen to fail to start when the base name of the instance is ds.

12183629/6490653

When enabling referral mode for Directory Server by using Directory Service Control Center through Internet Explorer 6, the text in the confirm referral mode window is truncated.

To work around this issue, use a different browser such as Mozilla web browser.

12182971/6488284

For the HP-UX platform, Directory Server Enterprise Edition man pages for the following sections cannot be accessed from the command line:

- man5dpconf.

- man5dsat.

- man5dsconf.

- man5dsoc.

- man5dssd.

To workaround this issue, access the man pages at Man Page Reference for Oracle Directory Server Enterprise Edition. From that location, you can download a PDF of all Directory Server Enterprise Edition man pages.

12182934/6488197

During installation on Windows systems, ODSEE relies on Windows permissions settings for file protection. Be sure your permissions are set appropriately.

To work around this issue, change the permissions on the installations and server instance folders.

12182309/6485560

Directory Service Control Center does not allow you to browse a suffix that is configured to return a referral to another suffix.

12181717/6483290

Neither Directory Service Control Center nor the dsconf command allows you to configure how Directory Server handles invalid plug-in signatures. Default behavior is to verify the plug-in signatures, but not to require that they are valid. Directory Server logs a warning for invalid signatures.

To change the server behavior, adjust the ds-require-valid-plugin-signature and ds-verify-valid-plugin-signature attributes on cn=config. Both attributes take either on or off.

12177565/6469688

On Windows systems, the dsconf command has been seen to fail to import LDIF with double-byte characters in the LDIF file name.

To work around this issue, change the LDIF file name so that it does not contain double-byte characters.

12171105/6446318

On Windows, SASL authentication fails because SASL encryption is used.

To workaround the issue caused by the SASL encryption, stop the server, edit dse.ldif, and reset SASL to the following.

dn: cn=SASL, cn=security, cn=config
dssaslminssf: 0
dssaslmaxssf: 0

12162287/6416407

Directory Server does not correctly parse ACI target DNs containing escaped quotes or a single escaped comma. The following example modifications cause syntax errors.

dn:o=mary\"red\"doe,o=example.com
changetype:modify
add:aci
aci:(target="ldap:///o=mary\"red\"doe,o=example.com")
(targetattr="*")(version 3.0; acl "testQuotes";
allow (all) userdn ="ldap:///self";)

dn:o=Example Company\, Inc.,dc=example,dc=com
changetype:modify
add:aci
aci:(target="ldap:///o=Example Company\, Inc.,dc=example,dc=com")
(targetattr="*")(version 3.0; acl "testComma";
allow (all) userdn ="ldap:///self";)

Examples with more than one comma that has been escaped have been observed to parse correctly, however.

12157832/6401484

The dsconf accord-repl-agmt command cannot align authentication properties of the replication agreement when SSL client authentication is used on the destination suffix.

To work around this issue, store the supplier certificate in the configuration on the consumer, following these steps. The examples command shown are based on two instances on the same host.

1. Export the certificate to a file.
The following example shows how to perform the export for servers in /local/supplier and /local/consumer.

$ dsadm show-cert -F der -o /tmp/supplier-cert.txt \
/local/supplier defaultCert
$ dsadm show-cert -F der -o /tmp/consumer-cert.txt \
/local/consumer defaultCert

2. Exchange the client and supplier certificates.
The following example shows how to perform the exchange for servers in /local/supplier and /local/consumer.

$ dsadm add-cert --ca /local/consumer supplierCert \
/tmp/supplier-cert.txt
$ dsadm add-cert --ca /local/supplier consumerCert \
/tmp/consumer-cert.txt

3. Add the SSL client entry on the consumer, including the supplierCert certificate on a usercertificate;binary attribute, with the proper subjectDN.

4. Add the replication manager DN on the consumer.

$ dsconf set-suffix-prop suffix-dn repl-manager-bind-dn:entryDN

5. Update the rules in /local/consumer/alias/certmap.conf.

6. Restart both servers with the dsadm start command.

12110907/6235452

When entries are imported from LDIF, Directory Server does not generate createTimeStamp and modifyTimeStamp attributes.

LDIF import is optimized for speed. The import process does not generate these attributes. To work around this limitation, add rather than import the entries. Alternatively, preprocess the LDIF to add the attributes before import.

12096337/4979319

Some Directory Server error messages refer to the Database Errors Guide, which does not exist. If you cannot understand the meaning of a critical error message that is not documented, contact Oracle support.

5 Directory Proxy Server Bugs Fixed and Known Problems

This chapter contains important, product-specific information available at the time of release of Directory Proxy Server.

This chapter contains the following sections:

- Directory Proxy Server Bugs Fixed in This Release

- Known Directory Proxy Server Limitations

- Known Directory Proxy Server Bugs

Note:

Bug information has been migrated from one database to another. If a bug number contains 8 digits, then the detailed bug information is currently stored in the Oracle bug database BugDB. If a bug number contains 7 digits, then the detailed bug information originated in the legacy Sun bug database Bugster. In these Release Notes, a bug number may be listed using the form BugDB#/Bugster#.

5.1 Directory Proxy Server Bugs Fixed in This Release

The following table summarizes all bug fixes contained in Directory Proxy Server 11g Release 1 (11.1.1.7.0.

Table 5-1 Directory Proxy Server Bugs Fixed in This Release

Bug ID

Description

14598827

Client connections hang, the following is reported in the DPS error log: ERROR - Fatal uncaughtException in Worker Thread 29.

14572322

Commands dpconf get-ldap-data-view-prop and dpconf set-ldap-data-view-prop throw errors when executed for the Views, and has Regexes set for pattern matching properties.

14474037

Directory Proxy Server property attr-name-mappings does not work as designed.

13932346

Bind fails. OutOfMemory error indicates err=48.

13904226

Uncaught NullPointerException in LDAPServer.java:1641.

13897891

Directory Proxy Server does not normalize a correctly escaped DN.

13859130

In the Directory Proxy Server, the connection identifier is duplicated among different clients.

13824718

The group-search-bind-dn search fails under heavy load. Significant decrease in performance occurs.

13681900

When you use the attr-value-mapping operation to replace a physical value with a virtual value, the results using ODSEE 11.1.1.5.0 are different from the results using DSEE 6.3.1.1.

13420539

On Directory Proxy Server, on the SQL backend, search fails if the basesearch contains uppercase letters.

13414748

Proxy cannot be registered when listenAddress is set to an IP address in conf.ldif.

13051513

On Directory Proxy Server, when data-view-use-internal-client-identity: true, the incorrect connection handler is used for the rebind.

13013661

When Virtual Transformation attributes are used, the Directory Proxy Server does not send the correct search filter to the Directory Server backend; expected search results are not returned.

12940451

When setting a resource policy within DSCC, client-side size limits are ignored.

12878532

On Directory Proxy Server 11.1.1.5.0, searches using uppercase or mixed-case base DNs to a backend SQL database fail.

12830373

Directory Proxy Server does not properly execute virtual transformations on multiple objectclasses.

12776191

On Directory Proxy Server, the Directory Server monitoring thread fails, resulting in a flood of monitoring searches.

12746975

Issue with mechanism for displaying error message produces exception messages

12736649

On Directory Proxy Server, connectionidletimeout is not set correctly for the resource limit policy.

12710604

Directory Proxy Server fails to answer client requests.

12707840

On revert-add-on-failure error, Directory Proxy Server error message wrongly removes added entry.

12553467

The dpconf utility does not support multiple-values for pattern matching attributes.

12387921

Directory Proxy Server closes incoming connections before processing LDAP_BIND().

12379417

When implementing the policy to follow referrals, Directory Proxy Server returns a wrong DN.

12379186

When implementing the policy to follow referrals, Directory Proxy Server returns a wrong DN.

12329768

The affinitydataview setting of a client connection to an invalid dataview results in a load-balancing issue.

12310346/7032421

Directory Proxy Server instances hang on the majority of new incoming SSL connections.

12308911/7024244

Updated support controls are not shown in the root DSE entry.

12308592/7022110

Potential denial of service with Directory Proxy Server after applying patch 6.3.1.1_CUMUL_2011_02_08.

12308112/7019397

LDAP control changes do not display until server is restarted.

12304016/7000801

When accessing Directory Proxy Server through LDAPS over a slow network connection, the client request hangs or times out.

12287888/6924686

When a virtual transformation is used that impacts DN, search entries are dropped because the search filter does not recognize the virtual transformation.

11908200

When searching the entire LDAP directory, the ldapsearch process hangs and displays multiple "Unsolicited Responses."

11798767

Connection handler thread is blocked in disconnect(). New operations are not handled by the Directory Proxy Server.

5.2 Known Directory Proxy Server Limitations

SSLv2Hello Protocol is Not Enabled in Directory Proxy Server

If you are using Java 7 (which is the default case), the SSLv2Hello protocol is disabled. So any client trying to negotiate with SSLv2Hello will fail to establish a connection with Directory Proxy Server. This impacts dpconf and DSCC if they are using Java 6 and using the SSLv2Hello protocol.

To work around this problem, do one of the following: Run dpconf or DSCC in Java 7, or enable the SSLv2Hello protocol in Directory Proxy Server.

Do not change file permissions by hand.

Changes to file permissions for installed Directory Server Enterprise Edition product files can in some cases prevent the software from operating properly. Only change file permissions when following instructions in the product documentation, or following instructions from Oracle support.

To workaround this limitation, install products and create server instances as a user having appropriate user and group permissions.

Self-signed server certificates cannot be renewed.

When using dsadm and dpadm to create a self-signed server certificate, be sure you specify a validity long enough that you do not have to renew the certificate. For more information, see the Administrator's Guide for Oracle Directory Server Enterprise Edition.

Directory Proxy Server does not ensure atomicity with the join data view write operations.

To ensure atomicity, do not use the join data view for write operations. If you perform write operations on join data view, use an external mechanism to prevent or detect inconsistencies. You can monitor inconsistencies by monitoring Directory Proxy Server error log.

Wrong default value in man pages

The log-buffer-size (5dpconf) man page displays the wrong default size of the access log buffer. The default buffer size for access log is 1M.

The man pages for pattern matching distribution algorithm incorrectly show the respective properties as single-valued. The properties are multi-valued.

When Oracle is the JDBC source, the ldapsearch command does not return an attribute with an empty value.

Oracle handles an empty string as NULL. The empty string and NULL are both valid values for an LDAP entry, but it is not possible to distinguish the two in Oracle. This issue was corrected for other JDBC sources in issue 6766175, as noted in Directory Proxy Server Bugs Fixed in This Release.

5.3 Known Directory Proxy Server Bugs

This section lists the known issues that are found at the time of Directory Proxy Server 11g Release 1 (11.1.1.7.0) release.

16097038

When changing the Directory Proxy Server certificate using DSCC, DSCC is no longer able to connect to the Directory Proxy Server. The Directory Proxy Server status indicates "Inaccessible."

As a workaround, go to the Proxy tab. Select and un-register the inaccessible server. Then register the server again.

12295282/6955510

If you do not provide a subject DN when creating a certificate request (using dpadm request-cert or DSCC), the default subject DN is cn=value,cn=value. The certificate request is issued without a warning, but the request is not accepted by most certificate authorities.

Similarly, if you do not provide a valid ISO 3166 country code when creating a certificate request (using dpadm request-cert or DSCC), the certificate request is issued without a warning, but the request is not accepted by the certificate authority.

12282391/6898084

The dpconf command binds as anonymous first when an SSL port is used. This may prevent the command from working in deployments where anonymous binds are rejected by the server.

12260509/6797954

The attr-value-mapping transformation comparisons are case-sensitive.

12258817/6790919

The Directory Proxy Server does not support IPv6 on windows.

12236820/6696857

If a Directory Proxy Server instance has only secure-listen-socket/port enabled through DSCC, and if the server certificate is not the default (for example, if it is a certificate-Authority-signed certificate), DSCC cannot be used to manage the instance.

To work around this problem, unregister the proxy server instance and then register it again. Alternatively, update the userCertificate information for the proxy server instance in the DSCC registry, using the server certificate.

12220848/6639674

If the Directory Proxy Server configuration property allow-bind-operations is set to false, it is not possible to connect on an SSL port using the dpconf command line argument with the -–secure-port option. Connection by Start TLS (default) or by clear connection (the -–unsecured option) are still possible.

12185916/6497547

Time limit and size limit settings work only with LDAP data sources.

12184892/6494540

After enabling or disabling non secure LDAP access for the first time, you must restart Directory Proxy Server for the change to take effect.

12182934/6488197

During installation on Windows systems, ODSEE relies on Windows permissions settings for file protection. Be sure your permissions are set appropriately.

To work around this issue, change the permissions on the installations and server instance folders.

12168899/6439604

After configuring alerts, you must restart Directory Proxy Server for the change to take effect.

12143951/6355714

Currently, GetEffectiveRights control is supported only for LDAP data views and does not yet take into account ACIs local to the proxy.

12080966/5042517

The modify DN operation is not supported for LDIF, JDBC, join and access control data views.

6 Directory Server Resource Kit Bugs Fixed and Known Problems

This chapter contains important, product-specific information available at the time of release of Directory Server Resource Kit.

This chapter includes the following sections:

- About the LDAP C-SDK for Oracle Directory Server Enterprise Edition

- Bugs Fixed in Directory Server Resource Kit

- Known Problems and Limitations in Directory Server Resource Kit

Note:

Bug information has been migrated from one database to another. If a bug number contains 8 digits, then the detailed bug information is currently stored in the Oracle bug database BugDB. If a bug number contains 7 digits, then the detailed bug information originated in the legacy Sun bug database Bugster. In these Release Notes, a bug number may be listed using the form BugDB#/Bugster#.

6.1 About the LDAP C-SDK for Oracle Directory Server Enterprise Edition

The LDAP C-SDK for Oracle Directory Server Enterprise Edition is now included in the ODSEE distributions. The LDAP C-SDK no longer exists as a separate component as it did in previous ODSEE releases.

See the following locations in the ZIP distributions:

- Lib: <install-path>/dsee7/lib/private

- Include: <install-path>/dsee7/include/private

- Tools: <install-path>/dsee7/dsrk/bin

You can download LDAP C-SDK Example Files from this location: http://www.oracle.com/technetwork/middleware/id-mgmt/learnmore/odsee11113-examples-350399.zip.

Also note that for a more recent LDAP C-SDK, you can use the Mozilla SDK. See http://wiki.mozilla.org/LDAP_C_SDK.

6.2 Bugs Fixed in Directory Server Resource Kit

This section lists the bugs fixed since the last release of Directory Server Resource Kit.

12151094/6379087

NameFinder has been seen to fail to deploy in Sun Java System Application Server on Windows systems.

6.3 Known Problems and Limitations in Directory Server Resource Kit

This section lists known problems and limitations at the time of release.

12205589/6576045

Killing modrate and searchrate launcher does not kill actual modrate and searchrate processes respectively.

12090777/5082507

The dsmlsearch command -D option takes an HTTP user ID rather than a bind DN.

To work around this issue, provide the user ID that is mapped to a DN in Directory Server.

12090469/5081549

authrate crashes on Windows systems when using multiple threads.

12090468/5081546

modrate crashes on Windows systems when using multiple threads.

12090467/5081543

searchrate crashes on Windows systems when using multiple threads.

Index
C  D  H  I  J  L  M  R  S

C

central log directories, Preface

certificate database

default path, Preface

D

default locations, Preface

H

hardware requirements, 3.2

I

install-path, Preface

instance-path, Preface

isw- hostname directory, Preface

J

Java Naming and Directory Interface, Preface

L

local log directory, Preface

M

Message Queue, Preface

R

requirements

hardware, 3.2

S

serverroot directory, Preface

SLAMD Distributed Load Generation Engine, Preface

Oracle Legal Notices

Copyright Notice

Copyright © 1994-2014, Oracle and/or its affiliates. All rights reserved.

Trademark Notice

Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners.

Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group.

License Restrictions Warranty/Consequential Damages Disclaimer

This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited.

Warranty Disclaimer

The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing.

Restricted Rights Notice

If this is software or related documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable:

U.S. GOVERNMENT END USERS: Oracle programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, delivered to U.S. Government end users are "commercial computer software" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, use, duplication, disclosure, modification, and adaptation of the programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, shall be subject to license terms and license restrictions applicable to the programs. No other rights are granted to the U.S. Government.

Hazardous Applications Notice

This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications that may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications.

Third-Party Content, Products, and Services Disclaimer

This software or hardware and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. Oracle Corporation and its affiliates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services.

Alpha and Beta Draft Documentation Notice

If this document is in preproduction status:

This documentation is in preproduction status and is intended for demonstration and preliminary use only. It may not be specific to the hardware on which you are using the software. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to this documentation and will not be responsible for any loss, costs, or damages incurred due to the use of this documentation.