Managing Server Configuration Set Entries

When you start an Oracle directory server by using the OID Control Utility, that start message refers to a configuration set entry containing server parameters. You can add, modify, and delete configuration set entries by using either Oracle Directory Manager or the appropriate command-line tool.

This section contains these topics:

• Preliminary Considerations for Managing Configuration Set Entries

• Managing Server Configuration Set Entries by Using Oracle Directory Manager

• Managing Server Configuration Set Entries by Using Command-Line Tools

  See Also: "Configuration Set Entries" for a conceptual overview of configuration set entries "Task 2: Start a Server Instance" for instructions on how to start the server by using OID Control Utility

Preliminary Considerations for Managing Configuration Set Entries

The configuration set entry configset0 is the default, and is used as the template for all new configuration set entries. Although you can change values in the default configuration set, all of your changes are then carried over to every new configuration set entry that you create.

To change values that should not be in effect for every server instance, it is better to create new configuration set entries. Note that this applies to the Oracle directory server and Oracle directory integration and provisioning server instances only. The Oracle replication directory server supports only one configuration set.

You may want to establish a separate instance of a directory server with different values. If you do not want those values to be exercised by all users, then set up a new configuration set entry and run a separate server instance pointing to that configuration set entry for groups with special needs.

Figure 5-1 shows three separate directory server instances, each with a different value.

Figure 5-1 Directory Entry Hierarchy Showing Multiple Configuration Set Entries

Text description of the illustration oidag017.gif

Figure 5-1 shows:

• An Oracle directory server (cn=osdldap) with:
  • One instance listening on the default port and using configset0 with SSL disabled

  • A second instance listening on the SSL port and using configset1 with SSL enabled

• A replication server instance (cn=osdrepld) using configset0

  Note: You can run multiple instances if the directory server is on the same computer. For example, you can run one instance in SSL mode and another in non-SSL mode.

  See Also: Chapter 13, "Secure Sockets Layer (SSL) and the Directory" for information about configuration parameters for SSL Chapter 25, "Oracle Directory Replication Administration" for information about configuration parameters for replication "Configuration Set Entry Schema Elements" for a list and descriptions of the entire set of attributes that are used to configure an instance of a directory server

Managing Server Configuration Set Entries by Using Oracle Directory Manager

You can use Oracle Directory Manager to view, add, modify, and delete configuration set entries.

Important Note: You cannot change the parameters for an active instance directly. Instead, you must change the parameters in a configuration set entry and save it. After the configuration set entry is saved, use the OID Control Utility restart command to stop current Oracle directory server instances and restart them. You can change a configuration set entry and start fresh instances that use the new parameters. The changes do not affect the older instances that are still running, however, unless they are restarted. For information on restarting directory server instances, see "Restarting Oracle Internet Directory Server Instances".

Viewing Configuration Set Entries by Using Oracle Directory Manager

To view configuration set entries:

1. In the navigator pane, expand each of the following objects in succession: Oracle Internet Directory Servers, directory server instance, Server Management.

2. Select Directory Server, Replication Server, or Integration Server. The parameters of the active instance appear in the right pane.

3. In the right pane, select an instance, then choose View Properties. A Server Process dialog box appears.

   You can see all the parameters for the instance by selecting the tabs across the top of the dialog box. However, you cannot change these parameters in this dialog box. To change them, you must change the configuration set entry on which they are based.

   See Also: "Modifying Configuration Set Entries by Using Oracle Directory Manager"

Adding Configuration Set Entries by Using Oracle Directory Manager

The first time you add a configuration set entry, you can:

• Use the default configuration set as a template for the new configuration set entry, then copy from it to make subsequent configuration sets

• Add a configuration set entry without copying from an existing one

Adding a Configuration Set Entry by Copying from the Default Configuration Set Entry

To add configuration set entries by copying the default configuration set entry:

1. In the navigator pane, expand each of the following objects in succession: Oracle Internet Directory Servers, directory server instance, Server Management, Directory Server.

2. Select Default Configuration Set.

3. On the toolbar, choose Create Like. The Configuration Sets dialog box displays the General tab page.

4. In the General tab page, fill in the fields. These are described in Table C-32.

5. Select the SSL Settings tab and fill in the fields. These are described in Table C-33.

6. Choose Apply.

7. Restart the server instance for the command to take effect.

   See Also: "Restarting Oracle Internet Directory Server Instances" Oracle Advanced Security Administrator's Guide for instructions on using the Oracle Wallet Manager to set the location of the Oracle Wallet and the Oracle Wallet password "Setting Debug Logging Levels"

Adding a Configuration Set Entry Without Copying from an Existing One

To create a new configuration set entry without copying from a previous configuration set entry:

1. In the navigator pane, expand each of the following objects in succession: Oracle Internet Directory Servers, directory server instance, Server Management, Directory Server.

2. Select Default Configuration Set.

3. On the toolbar, choose Create. A Configuration Sets dialog box displays the General tab page.

4. In the General tab page, fill in the fields. These are described in Table C-32.

5. Select the SSL Settings tab and fill in the fields. These are described in Table C-33 .

6. Choose OK.

Modifying Configuration Set Entries by Using Oracle Directory Manager

To modify configuration set entries:

1. In the navigator pane, expand each of the following objects in succession: Oracle Internet Directory Servers, directory server instance, Server Management, Directory Server.

2. Select the configuration set entry you want to modify. The configuration set appears in the group of tab pages in the right pane.

3. In the General tab page, modify the fields. These are described in Table C-32. To save the changes, choose Apply.

4. Select the SSL Settings tab and modify the fields. These are described in Table C-33. To save the changes, choose Apply.

5. Restart the server instance for the command to take effect.

   See Also: "Restarting Oracle Internet Directory Server Instances" Oracle Advanced Security Administrator's Guide for instructions on using the Oracle Wallet Manager to set the location of the Oracle Wallet and the Oracle Wallet password.

Deleting Configuration Set Entries by Using Oracle Directory Manager

To delete configuration set entries:

1. In the navigator pane, expand each of the following objects in succession: Server Management, Directory Server.

2. Select the configuration set entry you want to delete.

3. On the toolbar, choose Delete.

4. Restart the server instance for the command to take effect.

   See Also: "Restarting Oracle Internet Directory Server Instances"

Managing Server Configuration Set Entries by Using Command-Line Tools

Although changing configuration set entries by using Oracle Directory Manager is desirable, it can sometimes be more convenient to use the available command-line tools--for example, when you want to make the same set of changes across multiple Oracle directory servers.

When you add or modify configuration set entries by using the command-line tools, the input file for adding a new configuration set entry must be written in LDAP Data Interchange Format (LDIF). It must contain only the attributes and values that differ from the installed defaults. The directory server uses the attribute values that you establish in the new configuration set entry to override its own existing values for these attributes.

See Also: "LDAP Data Interchange Format (LDIF) Syntax" for information on LDIF

Adding Configuration Set Entries by Using ldapadd

If you are adding a new Oracle directory server instance, then you can either use an existing configuration set entry, or add a new one for the new instance.

To add a new configuration set entry, create an input file, and then load the input file with ldapadd. Follow these steps:

1. Create the input file in a text editor.

   Input files must use LDIF format. When you create the input file, you need to define or include only those attributes that differ from the current values in that configuration set entry.

   In this example, the parameter configset2 is the RDN, or local name, of the new entry and the wallet location is: /HOME/test/wallet.

   dn:cn=configset2, cn=osdldapd, cn=subconfigsubentry
   
   cn:configset2
   
   objectclass:orclConfigSet
   
   objectclass:orclLDAPSubConfig
   
   objectclass:top
   
   orclsslauthentication:1
   
   orclsslenable:1
   
   orclsslport:5000
   
   orclsslversion:3
   
   orclsslwalleturl:file:/HOME/test/wallet
   
   
   

2. Run ldapadd with an input file.

   At the system prompt, type the command to add the input file.

   ldapadd [options] -f LDIF_file_name 
   

   See Also: "LDAP Data Interchange Format (LDIF) Syntax" "ldapadd Syntax" for a detailed list of options available with this command "Configuration Set Entry Schema Elements" for a description of configuration set entry attributes

Modifying and Deleting Configuration Set Entries by Using ldapmodify

To modify or delete an existing configuration set entry, create an input file containing only the attributes that you want to change, and then load the input file with the ldapmodify command. Follow these steps:

1. Create the input file.

   When you create the input file, define or include only those attributes that differ from the installed defaults.

   Input files must have LDIF format.

   In the next example, the parameter cn=configset2,cn=osdldapd,cn=subconfigsubentry is the DN, or local name, of an existing configuration set entry. This example shows how to modify the ORCLSSLPORT parameter to 7000.

   dn:cn=configset2,cn=osdldapd,cn=subconfigsubentry
   
   changetype: modify
   
   replace: orclsslport
   
   orclsslport: 7000
   

2. Run ldapmodify referencing the input file.

   Type the command to reference the input file at the system prompt.

   ldapmodify [options] -f LDIF_file_name
   

   See Also: "LDAP Data Interchange Format (LDIF) Syntax" "ldapmodify Syntax" for a more detailed discussion of ldapmodify, and a list of its options "Configuration Set Entry Schema Elements" for a description of configuration set entry attributes