4
Using the Administration Tools

This chapter introduces the various administration tools of Oracle Internet Directory. It discusses the online administration tool, called Oracle Directory Manager, and tells you how to launch it, navigate through it, and connect to directory servers by using it. It also introduces the command line and bulk tools.

This chapter discusses these topics in the following sections:

• Using Oracle Directory Manager

• Using Command Line Tools

• Using Bulk Tools

• Using the Catalog Management Tool

• Using the OID Database Password Utility

• Administration Tasks at a Glance

Using Oracle Directory Manager

This section describes some of the basic features of Oracle Directory Manager. More specific instructions are found in sections explaining how to perform various tasks.

This section discusses the following tasks and features of Oracle Directory Manager:

• Starting Oracle Directory Manager

• Connecting to a Directory Server

• Navigating Oracle Directory Manager

• Connecting to Additional Directory Servers

• Disconnecting from a Directory Server

• Performing Administration Tasks by Using Oracle Directory Manager

Starting Oracle Directory Manager

Before you can launch Oracle Directory Manager, you must first have a directory server instance running.

If you do not already have a server instance running, follow the steps in Chapter 3 before attempting to start Oracle Directory Manager.

See Also: "Oracle Internet Directory Architecture" for a conceptual explanation of Oracle Directory Server instances

To start Oracle Directory Manager, follow the instructions for your platform:

Platform	Instructions
Windows NT or Windows 95	You can either: Type at the Run command: oidadmin Type at a DOS command prompt: oidadmin
Sun Solaris	Type at the system prompt: oidadmin

When you start Oracle Directory Manager for the first time, an alert tells you that you must connect to a server. Click OK.

Connecting to a Directory Server

1. The Directory Server Connection dialog box prompts you for the name and port number of an available server:

   
   

   The default port is 389. You can change the port if you wish. However, if you have an Oracle Directory Server running on a non-default port, be sure that any clients that will use it are informed of the correct port to use. Click OK. The Oracle Directory Manager Connect dialog box appears:

   
   
2. In each field of the Credentials tab page, type the information specific to this server instance as described in Table 4-1.

   Table 4-1 Credential Information

   Field	Description
   User	The first time you log in, do so either as the super user or anonymously. If you intend to configure SSL features during this session, login as the super user. If you are logging in as the super user, in the User box, type cn=orcladmin. If you are logging in anonymously, leave the User box empty. If you have already set up the user's entry by using LDAP command line tools, you can enter that user's entry in one of two ways: Browse and select that entry by using the button to the right of the User field or Type the distinguished name (DN) for that user's entry by using the correct format, for example, cn=Susie Brown,ou=HR,o=acme,c=us
   Password	If you are logging in as the super user and you specified a password for the super user during installation, in the Password box, type the password you specified. Otherwise, type the default password, namely, welcome. If you are logging in anonymously, leave the Password box empty. After you are logged into Oracle Directory Manager and have connected to a directory server, you should change this password to protect the directory. For instructions on how to do this, see "Managing Super, Guest, and Proxy Users".
   Server	Select the host containing the directory server to which you want to connect by selecting it from the Server list. If you are already connected to a directory server, and you want to connect to a directory server on a different host, click the button to the right of the Server field. A dialog box presents you with a list of available servers. Select the one you want and click OK. If you want to add a directory server, click Add. The Directory Server Connection dialog box appears. Type the name of the directory server you want to add, then click OK.
   Port	The default port (389) appears in this field. If there is more than one directory server instance on the same host, each directory server instance has a different port.
   SSL Enabled	You can connect to a directory server either with or without SSL. If you connect by using Secure Sockets Layer (SSL), then Oracle Directory Manager becomes an SSL client. All commands you issue through Oracle Directory Manager are then sent over SSL. You can connect in this way if both of the following two conditions are met: The server to which you are connecting uses SSL. If that server does not use SSL, and you select this check box, authentication will fail when you try to connect. You have already created a wallet containing a certificate and a list of trusted certificates. Selecting this check box causes all messages you issue by using Oracle Directory Manager to be sent over SSL.

   See Also: Chapter 8 for instructions on enabling SSL Appendix D for instructions on creating a wallet "Entries" for instructions on formatting distinguished names "Configuring SSL Parameters" for information about changing ports and their impact on security

3. If you selected the SSL Enabled check box on the Credentials tab, then select the SSL tab:

   
   

4. Enter the requested data in the fields as described in Table 4-2.

   Table 4-2 SSL Information

   Field	Description
   SSL Location	The location of the user's wallet. If the user's wallet is on the local machine, enter the wallet's path and file name. If the wallet is on another machine, link to that location, then enter the wallet's linked path and file name.
   SSL Password	The password to open the user's wallet
   SSL Authentication	Options are: No SSL Authentication--Neither the client nor the server authenticates itself to the other. No certificates are sent or exchanged. If you selected the SSL Enabled check box on the Credentials tab, and choose this option, only SSL encryption/decryption will be used. SSL Client and Server Authentication--Two-way authentication, that is, both client and server send certificates to each other. SSL Server Authentication--One-way authentication, that is, only the directory server authenticates itself to the client. The directory server sends its certificate to the client.

   Note: If the server requires two-way authentication, each Oracle Directory Manager user must have a unique wallet. If one-way authentication is specified, several Oracle Directory Manager users can use a single wallet.

5. Click Login. Oracle Directory Manager appears:

   
   

Navigating Oracle Directory Manager

Like the directory itself, the navigator pane (left side of the double window interface) has a tree-like structure. When Oracle Directory Manager first opens, the navigator pane shows only one tree item, "Oracle Internet Directory Servers." By clicking the plus sign(+) next to the tree item, subcomponents of that tree item appear. Tree items that have plus signs in front of them may have their own sub-tree items. The plus sign becomes a minus sign (-) when the entry is expanded. You can expand and contract the tree by clicking the plus signs and minus signs.

For example, if you click the plus sign next to Oracle Internet Directory Servers in the opening window navigator pane, the tree expands to show the connection information for the server to which you are connected:

By clicking the plus sign (+) next to the server information, you make a number of other choices appear in the navigator pane.

You can navigate around Oracle Directory Manager using one or a combination of the following options.

• Select menu items from the menus across the top of the window.

• Use buttons on the toolbar across the top of the left pane to perform such actions as create, create-like, and delete.

• Click the tree items in the navigator pane in combination with the options in the right pane. For example, as shown in Figure 4-1, clicking the navigator tree item Schema Management causes its associated tab pages to display in the right pane. You can view and manipulate information on the Schema Management's four tab pages by selecting tabs in the right pane.

• Some right panes also include buttons you can click to start a task. For example, in the Schema Management pane (Figure 4-1), buttons are available to create a new object, create a new object by copying an existing one (Create-Like), delete a selected object, edit a selected object, or find an object.

Figure 4-1 Schema Management Tab Pages

• Buttons at the bottom of the pane affect the whole pane. For example, in Figure 4-1, the Help button at the bottom of the pane displays the online help topic for the entire pane.

  Note: Some windows contain buttons labeled Apply and OK. If you press Apply, the changes you have made are committed, and the window remains available for more changes. If you press OK, the changes you have made are committed, and the window closes. Similarly, some windows have buttons that are labeled Revert and Cancel. If you press Revert, the changes you have made in that window do not take effect, and the window stays open for further work. If you press Cancel, the changes you have made in that window do not take effect, and the window closes.

The Oracle Directory Manager Menu Bar

Table 4-3 lists the menus you can access by using the menu bar, and describes the items in each menu. Menu items become enabled or disabled depending on the pane or tab page you are displaying in Oracle Directory Manager.

Table 4-3 Menu Bar

Menu	Menu Items
File	Create--Adds an object Create Like--Adds a new object by using the object selected in the navigator pane as a template Connect--Connects to a directory server selected in the navigator pane Disconnect--Disconnects from a directory server selected in the navigator pane Exit--Exits Oracle Directory Manager
Edit	Edit--Modifies an object Remove--Removes a selected object
View	Refresh--Updates data stored in memory to reflect changes in the database Tear-Off--Generates a secondary dialog containing the fields and values displayed in Oracle Directory Manager's right pane. Useful when comparing two pieces of information.
Operations	Create Object Class--Displays the New Object Class dialog box which you use to add a new object class Create Attribute--Displays the New Attribute Type dialog box that you use to add a new attribute to an entry Create Access Ctrl Point--Displays the New Access Control Point dialog box which you use to add a new Access Control Policy Point. For information on ACPs, see Chapter 9. Create Entry--Displays the New Entry dialog box which you use to add a new directory entry Configure Entry Management--Displays a dialog box with fields to set the maximum number of subentries and the maximum search time for entry management.
Help	Contents--Displays the Contents tab page of the Help navigator Search for Help On...--Displays the Help Search dialog box which you use to search for words in the online help guide About Oracle Internet Directory--Displays Oracle Internet Directory version information

The Oracle Directory Manager Toolbar

Figure 4-2 and the accompanying table illustrate and describe the Oracle Internet Directory toolbar. Buttons become enabled or disabled depending on the pane or tab page you are displaying in Oracle Directory Manager.

Figure 4-2 Oracle Directory Manager Toolbar

Button	Purpose
1	Connect/Disconnect--Connects to or disconnect from a directory server selected in the navigator pane
2	Refresh--Updates data for objects--other than entries--stored in memory to reflect changes in the database
3	Create--Adds a new object
4	Create Like--Adds a new object by using another object as a template
5	Edit--Modifies an object
6	Find Objects--Searches for an object
7	Remove--Removes an object
8	Refresh Entry--Updates data for entries stored in memory to reflect changes in the database
9	Refresh Subentries--Updates the children of entries stored in memory to reflect changes in the database
10	Drop Index--Removes an index from an attribute. When you click this button, an alert asks you to confirm that you want to drop the index.
11	Help--Displays the Help navigator

Connecting to Additional Directory Servers

You can connect to more than one directory server at the same time. This allows you to view and modify the data, schema, and security for each directory server. If you do this, each server is listed underneath Oracle Internet Directory Servers in the navigator pane.

To connect to an additional directory server:

1. In the navigator pane, expand Oracle Internet Directory Servers.

2. In the right pane, click New.

3. Follow the login procedures described in "Connecting to a Directory Server".

Disconnecting from a Directory Server

To disconnect from a directory server by using Oracle Directory Manager, choose File > Disconnect. Also, when you exit Oracle Directory Manager, connections between all directory servers and the directory are automatically disconnected.

All connection information is stored in the user's home directory in the file osdadmin.ini. For example, on a Solaris platform, the path name would be /$HOME/adsadmin.ini.

When you restart Oracle Directory Manager, all previously connected server connections appear in the Directory Server Login Window.

Performing Administration Tasks by Using Oracle Directory Manager

You can perform most of the Oracle Internet Directory administrative tasks through Oracle Directory Manager. Tasks that you cannot perform through Oracle Directory Manager involve running processes, such as starting and stopping the OID Monitor (oidmon) process and starting and stopping server instances. To perform tasks that you cannot perform with Oracle Directory Manager, use the appropriate LDAP command line tool.

The following table lists the task areas managed by Oracle Directory Manager and where to find instructions for using it in each area.

Task Area	Instructions
Schema administration	"Managing Object Classes by Using Oracle Directory Manager" "Managing Attributes by Using Oracle Directory Manager"
Entries management	"Managing Entries by Using Oracle Directory Manager"
ACP administration	"Managing Access Control by Using Oracle Directory Manager"
Partitioning and replication	Chapter 10

Using Command Line Tools

Oracle Internet Directory provides several command line tools for manipulating entries and attributes. This section explains the kind of task you can perform with each tool.

The command line tools act on entries that are in text files written in the LDAP Data Interchange Format (LDIF). An entry in the input file lists the DN, its attribute types (there may be many), and their values, with one attribute type per line.

See Also: "Using LDAP Data Interchange Format (LDIF)" before actually formatting an input LDIF file

The following table lists each command line tool, the task(s) you can perform with it, and where to find syntax and usage notes for it.

Tool	Task(s)	Syntax and Usage Notes
ldapsearch	Search for directory entries	"ldapsearch"
ldapbind	Authenticate user/client to a directory server	"ldapbind"
ldapadd	Add entries one at a time	"ldapadd"
ldapaddmt	Add several entries concurrently by using this multi-threaded tool	"ldapaddmt"
ldapmodify	Create, update, and delete attribute data for an entry	"ldapmodify"
ldapmodifymt	Modify several entries concurrently by using this multi-threaded tool	"ldapmodifymt"
ldapdelete	Delete entries.	"ldapdelete"
ldapcompare	See whether an entry contains a specified attribute value	"ldapcompare"
ldapmoddn	Modify the DN or RDN of an entry, rename an entry or a subtree, or move an entry or a subtree under a new parent.	"ldapmoddn"

See Also: "Using NLS with Command Line Tools" for a discussion of command line tools and NLS "Using Bulk Tools" for information on bulk command line tools

Using Bulk Tools

Bulk tools enable you to create and manage large numbers of directory entries from data residing in, or created by, other applications.

Important Note: To use these tools you must provide the Oracle Internet Directory password. The default password is ods, although the system administrator can change it by using the oidpassword tool. See Also: "Using the OID Database Password Utility"

The following table lists each bulk tool, the task(s) you can perform with it, and where to find syntax and usage notes for it.

Tool	Task(s)	Syntax and Usage Notes
bulkload	Load large number of entries to Oracle Internet Directory through LDIF files	"bulkload"
ldifwrite	Copy data from the directory information base into an LDIF file that can be read by any LDAP compliant directory server. You can use ldifwrite in conjunction with bulkload. You can also use ldifwrite to back up information from all or part of a directory.	"ldifwrite"
bulkmodify	Modify a large number of existing entries efficiently	"bulkmodify"
bulkdelete	Delete a subtree efficiently	"bulkdelete"

Using OID Control Utility

OID Control Utility is a command line tool for issuing run-server and stop-server commands. The commands are interpreted and executed by the OID Monitor process.

See Also: "Step Two: Start Server Instances" "Oracle Internet Directory Architecture" for a conceptual description

Using the Catalog Management Tool

Oracle Internet Directory uses indexes to make attributes available for searches. When Oracle Internet Directory is installed, the entry cn=catalogs lists available attributes that can be used in a search. Only those attributes that have an equality matching rule can be indexed.

If you want to use additional attributes in search filters, you must add them to the catalog entry by using the Catalog Management tool.

See Also: "Using the Catalog Management Tool" for syntax and usage notes

Using the OID Database Password Utility

The Oracle Internet Directory uses a password when connecting to an Oracle database. The default for this password when you install Oracle Internet Directory is ODS. You can change this password by using the OID Database Password Utility.

See Also: "Using the OID Database Password Utility" for syntax and usage notes

Administration Tasks at a Glance

Oracle Internet Directory administration tasks are described throughout this manual. Table 4-4 points you to the information you need for some of the more common tasks.

Table 4-4 Common Administration Tasks and Where To Find Instructions

Task	Information
Managing Attributes
Add, modify, or delete an attribute by using command line tools	"Managing Attributes by Using Command Line Tools"
Add, modify, or delete an attribute by using the Oracle Directory Manager	"Managing Attributes by Using Oracle Directory Manager"
Managing Entries
Add, modify, or delete a directory entry by using command line tools	"Managing Entries by Using Command Line Tools"
Add, modify, or delete a directory entry by using Oracle Directory Manager	"Managing Entries by Using Oracle Directory Manager"
Import bulk data files	"bulkload" "Using LDAP Data Interchange Format (LDIF)"
View Directory Information Tree (DIT) hierarchy of entries	"Managing Entries by Using Oracle Directory Manager"
Managing Object Classes
Add, modify, or delete object classes by using command line tools	"Managing Object Classes by Using Command Line Tools"
Add, modify, or delete object classes by using Oracle Directory Manager	"Managing Object Classes by Using Oracle Directory Manager"
Managing Security
Set up an Access Control Policy Point (ACP)	Chapter 9
Set up security	Chapter 8
Managing Servers
Configure server instance parameters by using command line tools	"Managing Server Configuration Set Entries by Using Command Line Tools"
Configure server instance parameters by using the Oracle Directory Manager	"Managing Server Configuration Set Entries by Using Oracle Directory Manager"
Connect to a directory by using Oracle Directory Manager	"Connecting to a Directory Server" "Connecting to Additional Directory Servers"
Run the directory server processes	Chapter 3
Stop the directory server processes	Chapter 3
View system operational attributes	"Setting System Operational Attributes"
Managing Replication
Set up replication	Chapter 10