Contents

List of Examples

List of Figures

List of Tables

Title and Copyright Information

Preface

• Who Should Use This Book
• Before You Read This Book
• How This Book Is Organized
• Examples Used in This Guide
• Oracle Directory Server Enterprise Edition Documentation Set
• Related Reading
• Redistributable Files
• Default Paths and Command Locations
• Typographic Conventions
• Shell Prompts in Command Examples
• Symbol Conventions
• Documentation, Support, and Training
• Oracle Software Resources
• Documentation Accessibility

1 Directory Server Enterprise Edition File Reference

• 1.1 Software Layout for Directory Server Enterprise Edition
• 1.2 Directory Server Instance Default Layout
• 1.3 Directory Proxy Server Instance Default Layout

Part I Directory Server Reference

2 Directory Server Overview

• 2.1 Introduction to Directory Server
• 2.2 Directory Server Architecture
  • 2.2.1 Comparison of Software Installation and Server Instances
  • 2.2.2 Communication With Client Applications
  • 2.2.3 Directory Server Configuration
  • 2.2.4 Data Storage in Directory Server
  • 2.2.5 Data Structuring With the Directory Information Tree
    • 2.2.5.1 DIT Terminology
  • 2.2.6 Data Replication Between Server Instances
  • 2.2.7 Access Control in Directory Server

3 Directory Server LDAP URLs

• 3.1 Components of an LDAP URL
• 3.2 Escaping Unsafe Characters
• 3.3 Examples of LDAP URLs

4 Directory Server LDIF and Search Filters

• 4.1 LDIF File Format
  • 4.1.1 Continuing Lines in LDIF
  • 4.1.2 Binary Data in LDIF
    • 4.1.2.1 Representing Binary Data by Using Standard LDIF Notation
    • 4.1.2.2 Representing Binary Data by Using the ldapmodify -b Command
    • 4.1.2.3 Representing Binary Data by Using Base 64 Encoding
• 4.2 Directory Entries in LDIF
  • 4.2.1 Organization Entries in LDIF
  • 4.2.2 Organizational Unit Entries in LDIF
  • 4.2.3 Organizational Person Entries in LDIF
• 4.3 Guidelines for Defining Directories by Using LDIF
• 4.4 Storing Information in Multiple Languages
• 4.5 Guidelines for Providing LDIF Input
  • 4.5.1 Terminating LDIF Input on the Command Line
  • 4.5.2 Using Special Characters
  • 4.5.3 Using Attribute OIDs
  • 4.5.4 Schema Checking
  • 4.5.5 Ordering of LDIF Entries
  • 4.5.6 Managing Large Entries
  • 4.5.7 Error Handling
• 4.6 Searching the Directory
  • 4.6.1 Searching the Directory With ldapsearch
    • 4.6.1.1 ldapsearch Command-Line Format
    • 4.6.1.2 Using Special Characters
  • 4.6.2 ldapsearch Examples
    • 4.6.2.1 Returning All Entries
    • 4.6.2.2 Specifying Search Filters on the Command Line
    • 4.6.2.3 Searching the Root DSE Entry
    • 4.6.2.4 Searching the Schema Entry
    • 4.6.2.5 Using LDAP_BASEDN
    • 4.6.2.6 Displaying Subsets of Attributes
    • 4.6.2.7 Searching Multi-Valued Attributes
    • 4.6.2.8 Using Client Authentication When Searching
  • 4.6.3 LDAP Search Filters
    • 4.6.3.1 Search Filter Syntax
    • 4.6.3.2 Using Attributes in Search Filters
    • 4.6.3.3 Using Operators in Search Filters
    • 4.6.3.4 Using OIDs in Search Filters
    • 4.6.3.5 Using Compound Search Filters
    • 4.6.3.6 Specifying Search Filters Using a File
    • 4.6.3.7 Specifying Non 7-Bit ASCII Characters in Search Filters
  • 4.6.4 Search Filter Examples
    • 4.6.4.1 Searching for Operational Attributes

5 Directory Server Security

• 5.1 How Directory Server Provides Security
• 5.2 How Directory Server Provides Access Control
  • 5.2.1 Introduction to ACIs
    • 5.2.1.1 Scope and Hierarchy in ACIs
    • 5.2.1.2 ACI Limitations
    • 5.2.1.3 Default ACIs
    • 5.2.1.4 ACIs and Replication
    • 5.2.1.5 Effective Rights
  • 5.2.2 Tuning Access Control Instructions
• 5.3 How Directory Server Provides Authentication
  • 5.3.1 Anonymous Access
  • 5.3.2 Password-Based Authentication
    • 5.3.2.1 Steps in Password-Based Authentication
    • 5.3.2.2 Password Policy
  • 5.3.3 Proxy Authorization
  • 5.3.4 Account Inactivation
  • 5.3.5 Global Account Lockout
  • 5.3.6 Certificate-based Authentication
    • 5.3.6.1 Introduction to Certificate-based Authentication
    • 5.3.6.2 Certificates and Certificate Authorities (CA)
    • 5.3.6.3 Types of Certificates
    • 5.3.6.4 Contents of a Certificate
    • 5.3.6.5 Certificate Management
  • 5.3.7 SASL-based Authentication
• 5.4 How Directory Server Provides Encryption
  • 5.4.1 Secure Sockets Layer (SSL)
    • 5.4.1.1 Overview of SSL
    • 5.4.1.2 Cryptographic Algorithms Used With SSL
    • 5.4.1.3 SSL Handshake
  • 5.4.2 Digital Signatures
  • 5.4.3 Key Encryption
    • 5.4.3.1 Symmetric-Key Encryption
    • 5.4.3.2 Public-Key Encryption
    • 5.4.3.3 Key Length and Encryption Strength
  • 5.4.4 Attribute Encryption

6 Directory Server Monitoring

• 6.1 Ways to Monitor Directory Server
• 6.2 Directory Server and SNMP
• 6.3 Directory Server Monitoring Attributes
  • 6.3.1 cn=monitor
    • 6.3.1.1 backendMonitorDN
    • 6.3.1.2 bytesSent
    • 6.3.1.3 cache-avail-bytes
    • 6.3.1.4 connection
    • 6.3.1.5 connectionPeak
    • 6.3.1.6 currentConnections
    • 6.3.1.7 currentTime
    • 6.3.1.8 dTableSize
    • 6.3.1.9 entriesSent
    • 6.3.1.10 nbackEnds
    • 6.3.1.11 opsCompleted
    • 6.3.1.12 opsInitiated
    • 6.3.1.13 request-que-backlog
    • 6.3.1.14 readWaiters
    • 6.3.1.15 currentpsearches
    • 6.3.1.16 startTime
    • 6.3.1.17 threads
    • 6.3.1.18 totalConnections
    • 6.3.1.19 version
  • 6.3.2 cn=disk,cn=monitor
    • 6.3.2.1 disk-dir
    • 6.3.2.2 disk-free
    • 6.3.2.3 disk-state
  • 6.3.3 cn=counters,cn=monitor
    • 6.3.3.1 backlogsum
    • 6.3.3.2 *etimesum
  • 6.3.4 cn=monitor,cn=Class of Service,cn=plugins, cn=config
    • 6.3.4.1 classicHashAvgClashListLength
    • 6.3.4.2 classicHashAvgClashPercentagePerHash
    • 6.3.4.3 classicHashMemUsage
    • 6.3.4.4 classicHashValuesMemUsage
    • 6.3.4.5 numClassicDefinitions
    • 6.3.4.6 numClassicHashTables
    • 6.3.4.7 numClassicTemplates
    • 6.3.4.8 numCoSAttributeTypes
    • 6.3.4.9 numIndirectDefinitions
    • 6.3.4.10 numPointerDefinitions
    • 6.3.4.11 numPointerTemplates

7 Directory Server Replication

• 7.1 Introduction to Replication
  • 7.1.1 Suppliers and Consumers
  • 7.1.2 Unit of Replication
  • 7.1.3 Replica Identity
  • 7.1.4 Types of Replica
  • 7.1.5 Replication Agreements
  • 7.1.6 Replication Authentication
  • 7.1.7 Replication Change Log
  • 7.1.8 Change Sequence Number
  • 7.1.9 Replica Update Vector
  • 7.1.10 Deleted Entries: Tombstones
  • 7.1.11 Consumer Initialization and Incremental Updates
  • 7.1.12 Referrals and Replication
• 7.2 Replication and the Retro Change Log Plug-In
  • 7.2.1 Retro Change Log and Multi-Master Replication
  • 7.2.2 Failover of the Retro Change Log
  • 7.2.3 Replication Conflicts and the Retro Change Log
  • 7.2.4 Restrictions on Using the Retro Change Log

8 Directory Server Data Caching

• 8.1 Types of Cache
  • 8.1.1 Database Cache
  • 8.1.2 Entry Cache
    • 8.1.2.1 How the Entry Cache Works
    • 8.1.2.2 Preloading the Entry Cache
    • 8.1.2.3 Modifying the Entry Cache Size
  • 8.1.3 Import Cache
  • 8.1.4 File System Cache
  • 8.1.5 Total Aggregate Cache Size
• 8.2 How Directory Server Performs Searches by Using Cache
  • 8.2.1 How Directory Server Performs Base Searches
  • 8.2.2 How Directory Server Performs Subtree and One-Level Searches
• 8.3 How Directory Server Performs Updates by Using the Cache
• 8.4 How Directory Server Initializes a Suffix by Using the Cache

9 Directory Server Indexing

• 9.1 Overview of Indexes
• 9.2 System Indexes and Default Indexes
  • 9.2.1 System Indexes
  • 9.2.2 Default Indexes
• 9.3 Types of Index
  • 9.3.1 Presence Index
  • 9.3.2 Equality Index
  • 9.3.3 Substring Index
  • 9.3.4 Browsing Index
  • 9.3.5 Approximate Index
  • 9.3.6 International Index

10 Directory Server Logging

• 10.1 Introduction to Logs
• 10.2 Transaction Log
• 10.3 Access, Error, and Audit Logs
  • 10.3.1 Access Logs
  • 10.3.2 Error Logs
  • 10.3.3 Audit Logs
  • 10.3.4 Content of Access, Error, and Audit Logs
    • 10.3.4.1 Time Stamp
    • 10.3.4.2 Connection Number
    • 10.3.4.3 File Descriptor
    • 10.3.4.4 Slot Number
    • 10.3.4.5 Operation Number
    • 10.3.4.6 Method Type
    • 10.3.4.7 LDAP Version
    • 10.3.4.8 Error Number
    • 10.3.4.9 Tag Number
    • 10.3.4.10 Number of Entries
    • 10.3.4.11 Elapsed Time
    • 10.3.4.12 LDAP Request Type
    • 10.3.4.13 LDAP Response Type
    • 10.3.4.14 Unindexed Search Indicator
    • 10.3.4.15 Extended Operation OID
    • 10.3.4.16 Change Sequence Number in Log Files
    • 10.3.4.17 Abandon Message
    • 10.3.4.18 Message ID
    • 10.3.4.19 SASL Multi-Stage Bind Logging
    • 10.3.4.20 Options Description
  • 10.3.5 Connection Codes in Log Files
  • 10.3.6 Result Codes in Log Files

11 Directory Server Groups and Roles

• 11.1 Directory Server Groups
  • 11.1.1 Static Groups
  • 11.1.2 Dynamic Groups
  • 11.1.3 Nested Groups
• 11.2 Directory Server Roles
  • 11.2.1 Managed Roles
  • 11.2.2 Filtered Roles
  • 11.2.3 Nested Roles
  • 11.2.4 Limitations on Using Roles
• 11.3 Deciding Between Groups and Roles
  • 11.3.1 Advantages of the Groups Mechanism
  • 11.3.2 Advantages of the Roles Mechanism
  • 11.3.3 Restricting Permissions on Roles

12 Directory Server Class of Service

• 12.1 About CoS
• 12.2 CoS Definition Entries and CoS Template Entries
  • 12.2.1 CoS Definition Entry
  • 12.2.2 CoS Template Entry
• 12.3 Pointer CoS, Indirect CoS, and Classic CoS
  • 12.3.1 Pointer CoS
  • 12.3.2 Indirect CoS
  • 12.3.3 Classic CoS
• 12.4 Managing Attributes With Class of Service
  • 12.4.1 Using CoS When Many Entries Share the Same Value
  • 12.4.2 Using CoS When Entries Have Natural Relationships
  • 12.4.3 Avoiding Excessive CoS Definitions
• 12.5 CoS Priorities
• 12.6 CoS Limitations

13 Directory Server DSMLv2

• 13.1 Introduction to DSML
• 13.2 Implementation of the DSMLv2 Standard
• 13.3 DSML Security
• 13.4 DSML Identity Mapping
• 13.5 Content of the HTTP Header
• 13.6 Accessing the Directory Using DSMLv2
  • 13.6.1 An Empty Anonymous DSML Ping Request
  • 13.6.2 Issuing a DSML Request to Bind as a Particular User
  • 13.6.3 A DSML Search Request

14 Directory Server Internationalization Support

• 14.1 About Locales
• 14.2 Identifying Supported Locales
• 14.3 Supported Language Subtypes

Part II Directory Proxy Server Reference

15 Directory Proxy Server Overview

• 15.1 Introduction to Directory Proxy Server
• 15.2 Directory Proxy Server Architecture
• 15.3 Overview of Directory Proxy Server Features

16 Directory Proxy Server Load Balancing and Client Affinity

• 16.1 LDAP Data Source Pools
• 16.2 Load Balancing
  • 16.2.1 Introduction to Load Balancing
  • 16.2.2 Proportional Algorithm for Load Balancing
  • 16.2.3 Saturation Algorithm for Load Balancing
  • 16.2.4 Operational Affinity Algorithm for Load Balancing
    • 16.2.4.1 Disadvantage of Using the Operational Affinity Algorithm for Load Balancing
    • 16.2.4.2 Operational Affinity Algorithm for Global Account Lockout
    • 16.2.4.3 Operational Affinity Algorithm for Cache Optimization
  • 16.2.5 Failover Algorithm for Load Balancing
  • 16.2.6 Adaptive Failover Algorithm for Load Balancing
  • 16.2.7 Fastest Server Algorithm for Load Balancing
• 16.3 Client Affinity

17 Directory Proxy Server Distribution

• 17.1 LDAP Data Views
  • 17.1.1 LDAP Data View Features
    • 17.1.1.1 Excluding a Subtree From a Data View
    • 17.1.1.2 Performing a Search Directed at a Superior Data View on an Excluded, Subordinate Data View
    • 17.1.1.3 Attribute Renaming and DN Renaming
• 17.2 Distributing Entries In a Subtree to Different Data Views
  • 17.2.1 Limitations of Distribution Algorithms
• 17.3 Use Cases for Data Views
  • 17.3.1 Data Views to Route All Requests, Irrespective of the Target DN of the Request
  • 17.3.2 Data Views to Route Requests When a List of Subtrees Are Stored on Multiple, Data-Equivalent Data Sources
  • 17.3.3 Data Views to Provide a Single Point of Access When Different Subtrees Are Stored on Different Data Sources
  • 17.3.4 Data Views to Route Requests When Different Parts of a Subtree Are Stored in Different Data Sources
  • 17.3.5 Data Views to Route Requests When Superior and Subordinate Subtrees Are Stored in Different Data Sources
  • 17.3.6 Data Views With Hierarchy and a Distribution Algorithm

18 Directory Proxy Server Virtualization

• 18.1 Construction of Virtual Data Views
• 18.2 Virtual Data Transformations
  • 18.2.1 Transformation Models
    • 18.2.1.1 Mapping Transformations
    • 18.2.1.2 Write Transformations
    • 18.2.1.3 Read Transformations
  • 18.2.2 Transformation Actions
  • 18.2.3 Transformation Parameters
  • 18.2.4 Transformation Examples
• 18.3 Additional Virtual Data View Properties
• 18.4 Join Data Views
  • 18.4.1 Primary and Secondary Data Views
  • 18.4.2 Additional Secondary Data View Properties
    • 18.4.2.1 Join Rules
    • 18.4.2.2 Handling of Shared Entries
    • 18.4.2.3 Handling of Binds
  • 18.4.3 How Directory Proxy Server Handles Read and Write Operations to Join Data Views
  • 18.4.4 Virtual Data Transformations on Join Data Views
• 18.5 Coordinator Data Views
  • 18.5.1 Features of Coordinator Data View
• 18.6 LDIF Data Views
• 18.7 JDBC Data Views
  • 18.7.1 JDBC Data Sources and Data Source Pools
  • 18.7.2 JDBC Object Classes
  • 18.7.3 JDBC Tables
  • 18.7.4 JDBC Attributes
  • 18.7.5 Case Sensitivity in JDBC Data Views
• 18.8 Access Control On Virtual Data Views
  • 18.8.1 Virtual ACI Definition
  • 18.8.2 Global ACIs
  • 18.8.3 Virtual ACI Syntax
  • 18.8.4 Virtual ACI Storage and Access
  • 18.8.5 Virtual ACI Application
• 18.9 Virtual Schema Checking
  • 18.9.1 Schema Checking
• 18.10 Virtual Data Views and LDAP Groups

19 Connections Between Directory Proxy Server and Backend LDAP Servers

• 19.1 LDAP Data Sources
• 19.2 Connections Between Directory Proxy Server and Backend LDAP Servers
  • 19.2.1 Opening and Closing Connections Between Directory Proxy Server and Backend LDAP Servers
  • 19.2.2 Connection Pools Between Directory Proxy Server and Backend LDAP Servers
• 19.3 Forwarding Request From Directory Proxy Server to Backend LDAP Servers
  • 19.3.1 Directory Proxy Server Configured for BIND Replay
  • 19.3.2 Directory Proxy Server Configured for Proxy Authorization
    • 19.3.2.1 Connections When Directory Proxy Server Is Configured for Proxy Authorization
    • 19.3.2.2 Directory Proxy Server Configured for Proxy Authorization and the Client Request Does Not Contain a Proxy Authorization
    • 19.3.2.3 Directory Proxy Server Configured for Proxy Authorization and the Client Request Does Contain a Proxy Authorization
    • 19.3.2.4 Security Issues When Directory Proxy Server Is Configured for Proxy Authorization
  • 19.3.3 Directory Proxy Server Configured to Forward Requests Without the Client Identity
  • 19.3.4 Directory Proxy Server Configured to Forward Requests As an Alternate User

20 Connections Between Clients and Directory Proxy Server

• 20.1 Criteria for Allocating a Connection to a Connection Handler
• 20.2 Data Views for Connection Handlers
• 20.3 Resource Limits Policies for Connection Handlers
  • 20.3.1 Customized Search Limits
• 20.4 Request Filtering Policies for Connection Handlers
  • 20.4.1 Subtrees in the Request Filtering Policy
    • 20.4.1.1 Allowed Subtrees
    • 20.4.1.2 Prohibited Subtrees
  • 20.4.2 Search Data Hiding Rules in the Request Filtering Policy

21 Directory Proxy Server Client Authentication

• 21.1 Client Authentication Overview
• 21.2 Simple Bind Authentication
  • 21.2.1 Password Encryption and Verification
• 21.3 Certificate-Based Authentication
  • 21.3.1 Configuring Certificates in Directory Proxy Server
  • 21.3.2 Using SASL External Bind
• 21.4 Anonymous Access
• 21.5 Directory Proxy Server Client Listeners

22 Security in Directory Proxy Server

• 22.1 How Directory Proxy Server Provides Security
• 22.2 Secure Sockets Layer for Directory Proxy Server
• 22.3 Ciphers and Protocols for Directory Proxy Server

23 Directory Proxy Server Logging

• 23.1 Introduction to Directory Proxy Server Logs
• 23.2 Log File Rotation
• 23.3 Log File Deletion
• 23.4 Message Severity
• 23.5 Error Logs for Directory Proxy Server
  • 23.5.1 Error Log Levels
  • 23.5.2 Format of an Error Message
• 23.6 Access Logs for Directory Proxy Server
  • 23.6.1 Access Log Levels
  • 23.6.2 Format of an Access Log Message
  • 23.6.3 Message Parts in an Access Log
  • 23.6.4 Access Log Buffer
• 23.7 Bind Logs for Directory Proxy Server
  • 23.7.1 Format of a Bind Log Message
  • 23.7.2 Message Part in a Bind Log
  • 23.7.3 Bind Log Buffer
• 23.8 Connection Logs for Directory Proxy Server
  • 23.8.1 Format of a Connection Log Message
  • 23.8.2 Message Part in a Connection Log
  • 23.8.3 Connection Log Buffer
• 23.9 Tracking Client Requests Through Directory Proxy Server and Directory Server Access Logs
  • 23.9.1 Simplify Connection Tracking
  • 23.9.2 Tracking Operations by Connection
    • 23.9.2.1 Tracking Operations in Directory Proxy Server
    • 23.9.2.2 Tracking Operations Between Directory Proxy Server and Directory Server
  • 23.9.3 Client Identification

24 Directory Proxy Server Alerts and Monitoring

• 24.1 Administrative Alerts for Directory Proxy Server
• 24.2 Monitoring Data Sources
  • 24.2.1 How Data Sources Are Monitored
    • 24.2.1.1 Monitoring a Data Source by Listening for Errors
    • 24.2.1.2 Monitoring Data Sources by Periodically Establishing Dedicated Connections
    • 24.2.1.3 Monitoring Data Sources by Testing Established Connections
  • 24.2.2 Responding to the Failure of a Data Source
• 24.3 Monitoring Directory Proxy Server
  • 24.3.1 Simplified Layout of the cn=monitor Entry
  • 24.3.2 Status of Monitored Information
  • 24.3.3 Description of Each Entry Under the cn=monitor Entry
    • 24.3.3.1 cn=Product
    • 24.3.3.2 cn=Operating System
    • 24.3.3.3 cn=Instance
    • 24.3.3.4 cn=Service
    • 24.3.3.5 cn=SAP
    • 24.3.3.6 cn=RSAP
    • 24.3.3.7 cn=Component
    • 24.3.3.8 cn=JVM
    • 24.3.3.9 cn=Resource
  • 24.3.4 Detailed Layout of the cn=monitor Entry

Index