5
Oracle Directory Server Administration

This chapter explains how to manage an Oracle directory server by using Oracle Directory Manager and command-line tools.

This chapter contains these topics:

• Managing Server Configuration Set Entries
• Setting System Operational Attributes
• Managing Naming Contexts
• Managing Super Users, Guest Users, and Proxy Users
• Configuring Searches
• Monitoring, Debugging, and Auditing the Directory Server
• Viewing Active Server Instance Information
• Changing the Password to an Oracle Database Server
• Dereferencing Alias Entries

  See Also: Chapter 3, "Preliminary Tasks and Information" for instructions on starting and stopping directory server instances

Managing Server Configuration Set Entries

When you start an Oracle directory server by using the OID Control Utility, that start message refers to a configuration set entry containing server parameters. You can add, modify, and delete configuration set entries by using either Oracle Directory Manager or the appropriate command-line tool.

Note: you can run multiple instances if the directory server on the same machine. For example, you can run one server in SSL mode and another in non-SSL mode. However, all directory server instances using a given database server MUST run on the same computer. For example, you cannot run two directory servers--one on Computer A and another on Computer B--against a database server on Computer C. You can, however, run both directory servers on Computer A against a database server on Computer B.

See Also: "Configuration Set Entries" for a conceptual overview of configuration set entries "Task 2: Start a Server Instance" for instructions on how to start the server by using OID Control Utility

This section contains these topics:

• Preliminary Considerations for Managing Configuration Set Entries
• Managing Server Configuration Set Entries by Using Oracle Directory Manager
• Managing Server Configuration Set Entries by Using Command-Line Tools

Preliminary Considerations for Managing Configuration Set Entries

Although you can change values in the default configuration set, namely, configset0, all of your changes will be carried over to every new configuration set entry that you create. This is because configset0 values are used as the template for all new configuration set entries.

When you want to change values that should not always be in effect for every instance of the server that you run, it is better to create new configuration set entries. Note that this applies to the Oracle directory server instances only. The Oracle replication directory server supports only one configuration set.

You may want to establish a separate instance of a directory server with different values. If you do not want those values to be exercised by all users, set up a new configuration set entry and run a separate server instance pointing to that configuration set entry for groups with special needs.

Figure 5-1 shows three separate directory server instances, each with a different value.

Figure 5-1 Directory Entry Hierarchy Showing Multiple Configuration Set Entries

Text description of the illustration oidag017.gif

Figure 5-1 shows:

• An Oracle directory server (cn=osdldap) with:
  • One instance listening on the default port and using configset0 with SSL set to off
  • A second instance listening on the SSL port and using configset1 with SSL set to on
• A replication server instance (cn=osdrepld) using configset0

  See Also: Chapter 11, "Secure Sockets Layer (SSL) and the Directory" for information about configuration parameters for SSL Chapter 22, "Oracle Directory Replication Server Administration" for information about configuration parameters for replication "Configuration Set Entry Attributes" for a list and descriptions of the entire set of attributes that are used to configure an instance of a directory server

Managing Server Configuration Set Entries by Using Oracle Directory Manager

You can use Oracle Directory Manager to view, add, modify, and delete configuration set entries.

Important Note: You cannot change the parameters for an active instance directly; you must change the parameters in a configuration set entry and save it. After the configuration set entry is saved, use the OID Control Utility restart command to stop current Oracle directory server instances and restart them. You can change a configuration set entry and start fresh instances that use the new parameters. The changes will not affect the older instances that are still running, however, unless they have been restarted. For information on restarting directory server instances, see "Task 3: Reset the Default Security Configuration".

Viewing Configuration Set Entries by Using Oracle Directory Manager

To view configuration set entries:

1. In the navigator pane, expand Oracle Internet Directory Servers > directory server instance > Server Management, then select Directory Server or Replication Server. The parameters of the active instance appear in the right pane.
2. Choose a specific instance in the right pane. A Server Process dialog box appears.

   You can see all the parameters for the instance by selecting the tabs across the top of the dialog box. However, you cannot change them in this dialog box. To change them, you must change the configuration set entry on which they are based.

   See Also: "Modifying Configuration Set Entries by Using Oracle Directory Manager"

Adding Configuration Set Entries by Using Oracle Directory Manager

The first time you add a configuration set entry, you can:

• Use the default configuration set as a template, then copy from the ones you create to make subsequent configuration sets
• Add a configuration set entry without copying from an existing one

Adding a Configuration Set Entry by Copying from the Default Configuration Set Entry

To add configuration set entries by copying the default configuration set entry:

1. In the navigator pane, expand Oracle Internet Directory Servers > directory server instance > Server Management > Directory Server, then select Default Configuration Set.
2. On the toolbar, click the Create Like button. The Configuration Sets dialog box displays the General tab.
3. Fill in the fields with the information described in the following table:

   Field	Description
   Max. Number of DB Connections	Type the number of concurrent database connections a single directory server process can have. The default is ten.
   Number of Child Processes	Type the number of server processes a single instance can spawn. The default is one.
   Set	Type the number of the configuration set entry. The default configuration set is 0. There can be as many different configuration sets as needed. The same configuration set can be used by more than one instance if the parameter needs of the multiple instances are the same. The set number is not modifiable.

4. Select the SSL Settings tab and fill in the fields with the information described in this table:

   Field	Description
   SSL Enable	Set 0 for only non-secure operation; default port is 839, changeable below. Set 1 for only SSL authentication; default port is 636, changeable below. Set 2 for both non-secure operation and SSL authentication.
   SSL Authentication	Choose one of the following: No SSL Authentication--Neither the client nor the server authenticates itself to the other. No certificates are sent or exchanged. In this case, SSL encryption/decryption only is used. SSL Client and Server Authentication--Both client and server authenticate themselves to each other and send certificates to each other. SSL Server Authentication--Only the directory server authenticates itself to the client. The directory server sends the client a certificate verifying that the server is authentic.
   SSL Wallet URL	Type the location of the server-side SSL wallet. If you elect to change the location of the wallet, you must change this parameter. You must set the wallet location on both the client and the server. For example, on UNIX, you could set this parameter as follows: file:/home/my_dir/my_wallet On Windows NT, you could set this parameter as follows: file:C:\my_dir\my_wallet
   SSL Wallet Password	Type the password for the server-side wallet. This password was set during creation of the wallet. If you change the password, you must change this parameter.
   SSL Wallet Confirm Password	Retype the new password in this field when you change the password.
   SSL Port	The default SSL port is 636. You can change the SSL port.
   Non-SSL Port	The default non-SSL port is 839. You can change the non-SSL port.

5. Click Apply.

   Note: Remember: The changes will not affect the active directory server instance until you restart it. See "Restarting Directory Server Instances".

   See Also: Oracle Advanced Security Administrator's Guide for instructions on using the Oracle Wallet Manager to set the location of the Oracle Wallet and the Oracle Wallet password "Setting Debug Logging Levels by Using the OID Control Utility"

Adding a Configuration Set Entry Without Copying from an Existing One

To create a new configuration set entry without copying from a previous configuration set entry:

1. In the navigator pane, expand Oracle Internet Directory Servers > directory server instance > Server Management > Directory Server, then select Default Configuration Set.
2. On the toolbar, click Create. A Configuration Sets dialog box displays the General tab page. Fill in the fields as described in this table:

   Field	Description
   Max. Number of DB Connections	Type the number of concurrent database connections a single directory server process can have. The default is ten.
   Number of Child Processes	Type the number of server processes a single instance can spawn. The default is one.
   Set	Type the number of the configuration set entry. The default configuration set is 0. There can be as many different configuration sets as needed. The same configuration set can be used by more than one instance if the parameter needs of the multiple instances are the same. The set number is not modifiable.

3. Select the SSL Settings tab and fill in the fields with the information described in this table:

   Field	Description
   SSL Enable	Select to enable SSL authentication. If you do not select this check box, SSL is not enabled, and you do not need to set any other parameters on this page.
   SSL Authentication	Choose one of the following: No SSL Authentication--Neither the client nor the server authenticates itself to the other. No certificates are sent or exchanged. In this case, SSL encryption/decryption only is used. SSL Client and Server Authentication--Both client and server authenticate themselves to each other and send certificates to each other. SSL Server Authentication--Only the directory server authenticates itself to the client. The directory server sends the client a certificate verifying that the server is authentic.
   SSL Wallet URL	Type the location of the server-side SSL wallet. If you elect to change the location of the wallet, you must change this parameter. You must set the wallet location on both the client and the server. For example, on UNIX, you could set this parameter as follows: file:/home/my_dir/my_wallet On Windows NT, you could set this parameter as follows: file:C:\my_dir\my_wallet
   SSL Wallet Password	Type the password for the server-side wallet. This password was set during creation of the wallet. If you change the password, you must change this parameter.
   SSL Wallet Confirm Password	Retype the new password in this field when you change the password.
   SSL Port	The default SSL port is 636. You can change the SSL port.

4. Click Ok.

Modifying Configuration Set Entries by Using Oracle Directory Manager

To modify configuration set entries:

1. In the navigator pane, expand Oracle Internet Directory Servers > directory server instance > Server Management > Directory Server, then select the configuration set entry you want to modify. The configuration set appears in the group of tab pages in the right pane.

   Modify the values in the fields for the General tab as described in this table:

   Field	Description
   Max. Number of DB Connections	Type the number of concurrent database connections a single directory server process can have. The default is ten.
   Number of Child Processes	Type the number of server processes a single instance can spawn. The default is one.
   Set	Type the number of the configuration set entry. The default configuration set is 0. There can be as many different configuration sets as needed. The same configuration set can be used by more than one instance if the parameter needs of the multiple instances are the same. The set number is not modifiable.

   You can change any of the values. Press Apply to save the changes.

2. Select the SSL Settings tab. Modify the fields as described in the following table.

   Field	Description
   SSL Enable	Select to enable SSL authentication. If you do not select this check box, SSL is not enabled, and you do not need to set any other parameters on this page.
   SSL Authentication	Choose one of the following: No SSL Authentication--Neither the client nor the server authenticates itself to the other. No certificates are sent or exchanged. In this case, SSL encryption/decryption only is used. SSL Client and Server Authentication--Both client and server authenticate themselves to each other and send certificates to each other. SSL Server Authentication--Only the directory server authenticates itself to the client. The directory server sends the client a certificate verifying that the server is authentic.
   SSL Wallet URL	Type the location of the server-side SSL wallet. If you elect to change the location of the wallet, you must change this parameter. You must set the wallet location on both the client and the server. For example, on UNIX, you could set this parameter as follows: file:/home/my_dir/my_wallet On Windows NT, you could set this parameter as follows: file:C:\my_dir\my_wallet
   SSL Wallet Password	Type the password for the server-side wallet. This password was set during creation of the wallet. If you change the password, you must change this parameter.
   SSL Wallet Confirm Password	Retype the new password in this field when you change the password.
   SSL Port	The default SSL port is 636. You can change the SSL port.

3. Once you are satisfied with the parameters you have set for the new configuration set entry, click Apply.
4. Restart the server instance for the command to take effect.

   Note: Remember: The changes will not affect the active directory server instance until you restart it. See "Restarting Directory Server Instances".

   See Also: Oracle Advanced Security Administrator's Guide for instructions on using the Oracle Wallet Manager to set the location of the Oracle Wallet and the Oracle Wallet password.

Deleting Configuration Set Entries by Using Oracle Directory Manager

To delete configuration set entries:

1. In the navigator pane, expand Server Management > Directory Server.
2. In the navigator pane, select the configuration set entry you want to delete.
3. Click Delete on the toolbar.

   Note: Remember: The changes will not affect the active directory server instance until you restart it. See "Restarting Directory Server Instances".

Managing Server Configuration Set Entries by Using Command-Line Tools

Although changing configuration set entries by using Oracle Directory Manager is desirable, it can sometimes be more convenient to use the available command-line tools--for example, when you want to make the same set of changes across multiple Oracle directory servers.

When you add or modify configuration set entries by using the command-line tools, the input file for adding a new configuration set entry should be written in LDAP Data Interchange Format (LDIF). It should contain only the attributes and values that differ from the installed defaults. The directory server uses the attribute values that you establish in the new configuration set entry to override its own existing values for these attributes.

See Also: "LDAP Data Interchange Format (LDIF) Syntax" for information on LDIF

Adding Configuration Set Entries by Using ldapadd

If you are adding a new Oracle directory server instance, you can either use an existing configuration set entry, or add a new one for the new instance.

To add a new configuration set entry, create an input file, and then load the input file with ldapadd. Follow these steps:

1. Create the input file in a text editor.

   Input files must use LDIF format. When you create the input file, you need to define or include only those attributes that differ from the current values in that configuration set entry.

   In this example, the parameter configset2 is the RDN, or local name, of the new entry, the wallet location is: /HOME/test/wallet, and the password is welcome.

   dn:cn=configset2, cn=osdldapd, cn=subconfigsubentry
   
   cn:configset2
   
   objectclass:orclConfigSet
   
   objectclass:orclLDAPSubConfig
   
   objectclass:top
   
   orclsslauthentication:1
   
   orclsslenable:1
   
   orclsslport:5000
   
   orclsslversion:3
   
   orclsslwalletpasswd:welcome
   
   orclsslwalleturl:file:/HOME/test/wallet
   
   
   

2. Run ldapadd with an input file.

   At the system prompt, type the command to add the input file. If the previous example shown were given the file name newconfigs, the ldapadd command would look something like this:

   ldapadd [options] -f newconfigs 
   

   See Also: "LDAP Data Interchange Format (LDIF) Syntax" "ldapadd Syntax" for a detailed list of options available with this command "Configuration Set Entry Attributes" for a description of configuration set entry attributes

Modifying and Deleting Configuration Set Entries by Using ldapmodify

To modify or delete an existing configuration set entry, create an input file containing only the attributes that you want to change, and then load the input file with the ldapmodify command. Follow these steps:

1. Create the input file.

   When you create the input file, define or include only those attributes that differ from the installed defaults.

   Input files must have LDIF format.

   In the next example, the parameter cn=configset2,cn=osdldapd,cn=subconfigsubentry is the DN, or local name, of an existing configuration set entry. This example shows how to modify the ORCLSSLPORT parameter to 7000.

   dn:cn=configset2,cn=osdldapd,cn=subconfigsubentry
   
   changetype: modify
   
   replace: orclsslport
   
   orclsslport: 7000
   

2. Run ldapmodify referencing the input file.

   Type the command to reference the input file at the system prompt. For example, if the input file were named configfile, your ldapmodify command would look something like the command shown that follows:

   ldapmodify [options] -f configfile
   

   See Also: "LDAP Data Interchange Format (LDIF) Syntax" "ldapmodify Syntax" for a more detailed discussion of ldapmodify, and a list of its options "Configuration Set Entry Attributes" for a description of configuration set entry attributes

Setting System Operational Attributes

An operational attribute--as opposed to an application attribute--pertains to the operation of the directory itself. Some operational information is specified by the directory to control the server--for example, the time stamp for an entry. Other operational information, such as access information, is defined by administrators and is used by the directory program in its processing. You must have superuser privileges to set system operational attributes.

This section contains these topics:

• Setting System Operational Attributes by Using Oracle Directory Manager
• Setting System Operational Attributes by Using ldapmodify

  See Also: "Kinds of Attribute Information"

Setting System Operational Attributes by Using Oracle Directory Manager

You can view and set some of the operational attributes for each Oracle directory server to which you are connected by using Oracle Directory Manager. To do this, in the navigator pane, expand Oracle Internet Directory Servers, then select a server. System operational attributes appear in the right pane.

The next table describes the fields displayed in Oracle Directory Manager for each system operational attribute.

Field	Description	Default Value	Modifiable?
DIP Repository	Used by the directory replication server, and indicates whether change logs are to be generated in the consumer node for the Oracle directory integration server to consume.	FALSE	Yes
Enable Match DN Processing	If the base DN of a search request is not found, then the directory server returns the nearest DN that matches the specified base DN. Whether the directory server tries to find the nearest match DN is controlled by this attribute. If set to 1, then match DN processing is enabled. If set to 0, then match DN processing is disabled.	1	Yes
Indexed Attribute Locations	DN for the file containing all indexed attributes	cn=catalogs	No
Replication Log Location	DN of the entry holding the change log in this server	cn=changelog	No
Replication Status Location	DN of the entry holding the change status in this server	cn=changestatus	No
Process Instance Location	DN of the entry holding the Instance Registry in this server	cn=subregistrysubentry	No
Replication Agreements	DN of the entry holding the replication agreement	cn=orclareplagreements	No
Configuration Set Location	DN of the entry holding the top of the naming context in this server	cn=subconfigsubentry	No
Schema Definition Location	DN of the schema	cn=subschemasubentry	No
Supported Control List	Extension information for any LDAP operation. The control types supported by Oracle Internet Directory are listed as values of the supportedcontrol attribute in the root DSE. Each control type has an associated object identifier defined by the LDAP standard.The values of the supportedcontrol attribute are standard object identifiers assigned to control types.	manageDSACtrl	No
Password Encryption	Hash algorithm for encrypting the password. Options are: MD4 MD5 No encryption SHA UNIX Crypt	MD4	Yes
Enable Statistics Gathering	Indicates whether you want to enable or disable the Oracle Internet Directory Server Manageability framework. To enable, set this to 1. To disable, set it to 0.	0	Yes
Enable Anonymous Bind	Indicator of whether anonymous binds are allowed or not. If set to 1, then anonymous binds are allowed. If set to 0 (zero), then they are not allowed.	1	Yes
Server Mode	Indicator of whether data can be written to the server. You can change this value to either Read/Write or Read Only. Change the default to Read Only during replication process.	Read/Write	Choices are Read/Write and Read-Only
Supported LDAP Version	LDAP version that Oracle Internet Directory supports	LDAP Version 2 LDAP Version 3	Yes
Server Operation Time Limit	Maximum amount of time, in seconds, allowed for a search to be completed	3600	Yes
Query Entry Return Limit	Maximum number of entries to be returned by a search	1000	Yes
Upgrade in Progress	Reserved for upgrade	FALSE	No
Statistics Collection Interval	Specify how often you want to gather sample statistics--that is, the number of minutes in the interval. Set this to 1 or more minutes.	60	Yes
Entry Cache Size in Bytes	Specify the maximum number of bytes of RAM that the entry cache can use.	100M	Yes
Maximum Entries in Entry Cache	Specify the maximum number of entries that can be present in the entry cache.	25,000	Yes
Enable Entry Cache	Specify whether entry caching is enabled. The value for enabled is 1; the value for disabled is 0.	1	Yes
Enable Group Cache	The cache of privilege groups and ACL groups in the directory server. Using this cache improves the performance of access control evaluation for users when privilege and ACP groups are used in ACI. Use the group cache when a privilege group membership does not change frequently. If a privilege group membership does change frequently, then it is best to turn off the group cache. This is because, in such a case, computing a group cache increases overhead.	1	Yes
Directory Version	The version or release of Oracle Internet Directory that you are using	2.1.1.0.0	No

Setting System Operational Attributes by Using ldapmodify

The modifiable system operational attributes are:

Attribute	Description	Default
namingContexts	Topmost DNs for the naming contexts contained in this server. You must have super user privileges to publish a DN as a naming context.	none
orclCryptoScheme	Hash algorithm for encrypting the password. Options are: MD4 MD5 No encryption SHA UNIX Crypt	MD4
orclSizeLimit	Maximum number of entries to be returned by a search	1000
orclServerMode	Specification as to whether data can be written to the server. Change the default to Read-Only during replication process.	Read/Write
orclTimeLimit	Maximum amount of time, in seconds, allowed for a search to be completed	3600
orclecacheenabled	Specification as to whether entry caching is enabled. The value for enabled is 1; the value for disabled is 0.	1
orclecachemaxsize	Maximum number of bytes of RAM that the entry cache can use.	100M
orclecachemaxentries	Maximum number of entries that can be present in the entry cache.	25,000
orclDIPRepository	Used by the directory replication server, and indicates whether change logs are to be generated in the consumer node for the Oracle directory integration server to consume.	FALSE
orclEnableGroupCache	The cache of privilege groups and ACL groups in the directory server. Using this cache improves the performance of access control evaluation for users when privilege and ACP groups are used in ACI. Use the group cache when a privilege group membership does not change frequently. If a privilege group membership does change frequently, then it is best to turn off the group cache. This is because, in such a case, computing a group cache increases overhead.	1
orclMatchDNEnabled	If the base DN of a search request is not found, then the directory server returns the nearest DN that matches the specified base DN. Whether the directory server tries to find the nearest match DN is controlled by this attribute. If set to 1, then match DN processing is enabled. If set to 0, then match DN processing is disabled.	1
Orclanonymousbindsflag	Specification as to whether anonymous binds are allowed or not. If set to 1, then anonymous binds are allowed. If set to 0 (zero), then they are not allowed.	1
orclStatsPeriodicity	Specification as to how often you want to gather sample statistics--that is, the number of minutes in the interval. Set this to 1 or more minutes.	60
orclStatsFlag	Indicates whether you want to enable or disable the Oracle Internet Directory Server Manageability framework. To enable, set this to 1. To disable, set it to 0.	0

Note: Entry caching is automatically disabled in multiserver OID instances, irrespective of the value of orclecacheenabled.

See Also: "ldapmodify Syntax" for a more detailed discussion of ldapmodify, and a list of its options

Managing Naming Contexts

To enable users to search for specific naming contexts, you can publish those naming contexts. To do this, you specify the topmost entry of each naming context as a value of the namingContexts attribute in the root DSE.

For example, suppose you have a DIT with three major naming contexts, the topmost entries of which are c=uk, c=us, and c=de. If these entries are specified as values in the namingContexts attribute, then a user, by specifying the appropriate filter, can find information about them by searching the root DSE. The user can then focus the search--for example, by concentrating on the c=de naming context in particular.

To publish a naming context, you can use either Oracle Directory Manager or ldapmodify. The namingContexts attribute is multi-valued, so you can specify multiple naming contexts.

To search for published naming contexts, perform a base search on the root DSE with objectClass =* specified as a search filter. The retrieved information includes those entries specified inWthe namingContexts attribute.

Before you publish a naming context, be sure that:

• You are a directory administrator with the necessary access to the root DSE
• The topmost entry of that naming context exists in the directory

This section contains these topics:

• Publishing Naming Contexts by Using Oracle Directory Manager
• Publishing Naming Contexts by Using ldapmodify

Publishing Naming Contexts by Using Oracle Directory Manager

1. In the navigator pane, expand Oracle Internet Directory Servers and select the directory server on which you want to specify a naming context. The corresponding tab pages for that directory server appear in the right pane.
2. In the System Operational Attributes tab page, in the Naming Contexts field, enter the topmost DN of the naming context you want to publish. You can also click Browse to open a search window.
3. Click Apply.

Publishing Naming Contexts by Using ldapmodify

The following example input file specifies the entry c=uk as a naming context.

dn:
changetype: modify
add: namingcontexts
namingcontexts: c=uk

Managing Super Users, Guest Users, and Proxy Users

A super user is a special directory administrator who typically has full access to directory information. The default user name of the super user is orcladmin; the default password is welcome. Oracle Corporation recommends that you change the password immediately.

A guest user is one who is not an anonymous user, and, at the same time, does not have a specific user entry. The default user name for a guest user is guest; the default password is guest.

A proxy user, as described in "Indirect Authentication", is typically used in an environment with a middle tier such as a firewall or a RADIUS server. The default user name for a proxy user is proxy; the default password is proxy.

You can administer user names and passwords for the super, guest, and proxy users by using either Oracle Directory Manager or ldapmodify.

Note: It is possible to log on to the Oracle Directory Manager without giving a user name or password. If you do this, you have the privileges specified for an anonymous user. Anonymous users should have very limited privileges.

See Also: Chapter 12, "Directory Access Control" for information on how to set access rights

This section contains these topics:

• Managing Super, Guest, and Proxy Users by Using Oracle Directory Manager
• Managing Super, Guest, and Proxy Users by Using ldapmodify

Managing Super, Guest, and Proxy Users by Using Oracle Directory Manager

Note: The passwords for superusers, guest users, and proxy users are encrypted by default. You cannot modify them to send them in the clear.

To set a user name or password for a super user, a guest user, or a proxy user by using Oracle Directory Manager:

1. In the navigator pane, expand Oracle Internet Directory Servers.
2. Select a server. The group of tab pages for that server appear in the right pane.
3. Select the System Passwords tab. This page displays the current user names and passwords for each type of user. Note that passwords are not displayed in the password fields.

   The next table lists and describes the fields in the System Passwords tab page.

   Field	Description
   Super User Name	Type the super user name. The default is orcladmin.
   Super User Password	Type the super user password. The default is welcome. You should change this password immediately.
   Guest Login Name	Type the guest login name. Guests have privileges determined by the access control policy point in the directory. The default is guest.
   Guest Login Password	Type the guest login password. The default is guest.
   Proxy Login Name	Type the proxy login name. Proxy users have privileges determined by the ACPs in the directory. The default is proxy.
   Proxy Login Password	Type the proxy login password. The default is proxy. You should change this password immediately.

4. Edit the appropriate field in the System Passwords tab page. To save your changes, click Apply.

Managing Super, Guest, and Proxy Users by Using ldapmodify

To set or modify a user name or password for a superuser, a guest user, or a proxy user, use ldapmodify to modify the appropriate attribute:

User Name/Password	Attribute
Super user name	orclsuname
Super user password	orclsupassword
Guest user name	orclguname
Guest user password	orclgupassword
Proxy user name	orclprname
Proxy user password	orclprpassword

For example, to change the password of the super user to superuserpassword, use ldapmodify to modify the directory-specific entry (DSE) by using an LDIF file containing the following:

dn: 
changetype:modify
replace:orclsupassword
orclsupassword:superuserpassword

See Also: "ldapmodify Syntax" for ldapmodify syntax and usage notes.

Configuring Searches

You can set the maximum number of entries returned in searches, as well as the maximum amount of time, in seconds, for searches to be completed. You can do both of these by using either Oracle Directory Manager or ldapmodify.

This section contains these topics:

• Configuring Searches by Using Oracle Directory Manager
• Configuring Searches by Using ldapmodify

Configuring Searches by Using Oracle Directory Manager

You can use Oracle Directory Manager to set the maximum number of retries returned in searches and the maximum amount of time to allow for searches.

Setting the Maximum Number of Entries Returned in Searches by Using Oracle Directory Manager

1. In the navigator pane, expand Oracle Internet Directory Servers and select a directory server instance. The group of tab pages for that server appear in the right pane.
2. In the System Operational Attributes tab page, in the Query Entry Return Limit field, enter the maximum number of entries to be returned by a search. The default is 1000.
3. Click Apply.

Setting the Maximum Amount of Time For Searches by Using Oracle Directory Manager

1. In the navigator pane, expand Oracle Internet Directory Servers and select a directory server instance. The group of tab pages for that server appear in the right pane.
2. In the System Operational Attributes tab page, in the Server Operation Time Limit, enter the maximum number of seconds for a search to be completed. The default is 3600.
3. Click Apply.

Configuring Searches by Using ldapmodify

You can use ldamodify to set the maximum number of retries returned in searches and the maximum amount of time to allow for searches.

Setting the Maximum Number of Entries Returned in Searches by Using ldapmodify

The following example changes the maximum number of entries to be returned in searches to 500.

ldapmodify -h myhost -p 389 -v <<EOF
dn:
changetype: modify
replace: orclsizelimit
orclsizelimit: 500
EOF

Setting the Maximum Amount of Time For Searches by Using ldapmodify

The following example changes the maximum amount of time for a search to 2400.

ldapmodify -h myhost -p 389 -v <<EOF
dn:
changetype: modify
replace: orcltimelimit
orcltimelimit: 2400

EOF

See Also: "ldapmodify Syntax"

Monitoring, Debugging, and Auditing the Directory Server

This section contains these topics:

• Setting Debug Logging Levels
• Using the Audit Log

Setting Debug Logging Levels

You can set debug logging levels by using either Oracle Directory Manager or the OID Control Utility.

This section contains these topics:

• Setting Debug Logging Levels by Using Oracle Directory Manager
• Setting Debug Logging Levels by Using the OID Control Utility

Setting Debug Logging Levels by Using Oracle Directory Manager

To set the debug logging level:

1. In the navigator pane, expand Oracle Internet Directory Servers and select a server instance. The group of tab pages for that server appear in the right pane.
2. Select the Debug Flags tab.

   Ordinarily, you can leave the check boxes on this tab page unselected. However, to generate a log for a specific problem, use this tab page to specify the debug logging level.

Setting Debug Logging Levels by Using the OID Control Utility

To set debug logging levels by using the OID Control Utility, restart the Oracle directory server using the -debug flag for an LDAP server, and the -d flag for the replication server. Use the debug level number based on Table 5-1.

Because debug levels are additive, you need to sum together the numbers representing the functions that you want to activate, and use that sum in the command-line option.

By default, debug logging is turned off. To turn it on, modify the directory-specific entry (DSE) attribute orcldebugflag to the level you want. You can configure debug levels to one of the following levels.

To see debug log files generated by the OID Control Utility, navigate to $ORACLE_HOME/ldap/log.

Table 5-1 provides the complete list of debug logging levels.

Table 5-1  Debug Logging Levels

Logging Level Value	Provides Information Regarding
1	Trace function calls
2	Debug packet handling
4	Heavy trace debugging (more information than level 1)
8	Connection management, related to network activities
16	Packets sent and received between server and client
32	Search filter processing
64	Configuration file processing
128	Access control list processing
256	Log of operations and results for each connection
512	Log of entries sent
1024	Log of communication with the back-end--that is, with the database
2048	Entry parsing
4096	Schema-related operations
32768	Replication-specific operations
65535	All possible debugging operations/data

For example, to trace function calls (1) and active connection management (8), enter 9 as the debug level (8 + 1 = 9) as follows:

oidctl server=oidldapd instance=1 flags='-debug 9' restart
oidctl server=oidrepld instance=1 flags='-h my_host -p 389 -d 9' restart

This example restarts both the Oracle directory server as well as the Oracle directory replication server with the debugging flags.

Using the Audit Log

The audit log records critical events on the Oracle directory server that are important from both a security and an operational point of view. Because the log generation depends on events on the directory server, you cannot create audit log entries. Only the directory server itself can create them.

The audit log is made up of regular directory entries, one entry for each event. You can query the audit log by using ldapsearch, and you can view the audit log entries by using Oracle Directory Manager.

By default, audit logging is disabled. To enable it, modify the directory-specific entry (DSE) attribute orclauditlevel to the level you want. You can configure audit levels to audit only selected events.

See Also: "Auditable Events" for a listing of audit levels "Setting the Audit Level" for instructions on specifying the audit level "Searching for Audit Log Entries by Using Oracle Directory Manager" "Searching for Audit Log Entries by Using ldapsearch" "ldapdelete Syntax"

Structure of Audit Log Entries

Each audit log entry contains the orclAuditoc object class. Like all other structural object classes, orclAuditoc inherits from top. Its attributes include:

Attribute	Description
orclsequence	Used to create the name of the entry. The name is generated using a database sequence.
orcleventtype	Specifies the type of event that occurred. This is a cataloged attribute.
orcleventtime	Specifies the time at which the event occurred. This is formatted in UTC (Coordinated Universal Time). UTC is indicated by a z at the end of the value. For example, orcleventtime: 199811281010z
orcluserdn	Specifies the identity of the user who logged into the Oracle directory server to perform the operation. This attribute is cataloged.
orclopresult	Specifies the outcome of the operation. It states either SUCCESS if the operation succeeds, or the reason why the operation failed.
orclauditmessage	Specifies the textual message. This attribute is not cataloged.
objectclass	Contains the preset values top and orclauditoc.

Note that the audit log entries do not become part of a regular search result set even though the search filter can satisfy the query criteria. For example, a search with the condition objectclass=top does not yield results from the auditlog entries. Only a search with cn=auditlog as the base of the search can find audit log entries.

Note: By default, the attributes orcleventtype and orcluserdn are indexed at installation of Oracle Internet Directory. If you drop the indexes from these attributes, you cannot search for them. To re-create the index for these attributes, use the Catalog Management tool. See "Indexing an Attribute by Using Command-Line Tools".

See Also: "The Catalog Management Tool" for information about cataloged attributes "Object Class Types" for a description of top

Position of Audit Log Entries in the DIT

The audit log container is part of the DSE. It holds its entries as children, organized according to the orclsequence attribute. See Figure 5-2.

Figure 5-2 Sample Audit Log in DSE

Text description of the illustration oidag018.gif

Auditable Events

Table 5-2 shows the auditable events and their audit levels. The third column, Audit Levels, contains hexidecimal values. You can audit more than one event by adding their corresponding values found in this column.

Table 5-2  Auditable Events

Event	Description	Audit Levels
Superuser login	Super user bind to the server (successes or failures)	0x0001
Schema element add/replace	Addition of a new schema element (successes or failures)	0x0002
Schema element delete	Deletion of a schema (successes or failures)	0x0004
Bind	Unsuccessful bind cases	0x0008
Access violation	Access denied by access control policy point	0x0010
directory-specific entry (DSE) modification	Changes to a DSE (successes or failures)	0x0020
Replication login	Replication server authentication (successes or failures)	0x0040
ACL modification	Changes to an access control list (ACL)	0x0080
User password modification	Modification of user password attribute	0x0100
Add	ldapadd operation (successes or failures)	0x0200
Delete	ldapdelete operation (successes or failures)	0x0400
Modify	ldapmodify operation (successes or failures)	0x0800
ModifyDN	ldapModifyDN operation (successes or failures)	0x1000

Setting the Audit Level

The setting for the DSE attribute orclauditlevel indicates the current audit level. You can enable or disable the events described in the previous section. A value of 0 for this attribute, which is the default, disables auditing.

You can set the audit level by using either Oracle Directory Manager or ldapmodify. This section describes both methods.

Setting the Audit Level by Using Oracle Directory Manager

To set the audit level by using Oracle Directory Manager:

1. In the navigator pane, expand Oracle Internet Directory Servers and select the directory server instance.
2. In the right pane, select the Audit Mask Levels tab page.
3. Select the check box for the audit level you want to use.
4. Click Apply.

Both successful and unsuccessful events are entered into the audit log if they are selected, except:

• Bind, which logs only unsuccessful bind attempts
• Access Violation, which logs only events in which access is denied by an ACP.

Restart the directory server instance after any changes are made to orclauditlevel for the changes to take effect.

See Also: "Restarting Directory Server Instances" for instructions on how to restart the directory server

See Also: "Auditable Events" for a description of each audit level

Setting the Audit Level by Using ldapmodify

To audit more than one event, add the values of their the audit masks. For example, suppose you want to audit the following three events:

Event	Audit Level	Value
Schema element delete	0x0004	4
DSE modification	0x0020	32
Add	0x0200	512
Total		548

The total value of the audit levels is 548. The ldapmodify command would therefore look something like this:

ldapmodify -p port -h host << EOF
dn:
changetype:modify
replace: orclauditlevel
orclauditlevel: 548
EOF

Restart the directory server instance after any changes are made to orclauditlevel for the changes to take effect.

See Also: "Restarting Directory Server Instances" for instructions on how to restart the directory server

Searching for Audit Log Entries

You can search for audit log entries by using either Oracle Directory Manager or ldapsearch.

Searching for Audit Log Entries by Using Oracle Directory Manager

To use Oracle Directory Manager to view audit log entries:

1. In the navigator pane, expand Oracle Internet Directory Servers > directory_server_instance, and select Audit Log Management. The corresponding right pane appears.
2. In the Max Results (entries) field, type the maximum number of entries you want your search to retrieve. The default is 200. The directory server retrieves the number you specify, up to 1000.
3. In the Max Search Time (seconds) box, type the maximum number of seconds for the duration of your search. The value you enter here must be at least that of the default, namely, 25. The directory server searches for the amount of time you specify, up to one hour.
4. In the Search Criteria box, use the lists and text fields on the search criteria bar to focus your search.
   1. From the list at the left end of the search criteria bar, select an attribute of the entry for which you want to search. Because not all attributes are used in every entry, be sure that the attribute you specify actually corresponds to one in the entry for which you are searching. Otherwise, the search fails.
   2. From the list in the middle of the search criteria bar, select a filter. Options are:

      Filter	Description
      Begins With	Searches by using only the first few characters of the attribute's value.
      Ends With	Searches for an entry by using only the last few characters of the specified attribute's value.
      Contains	Searches for an entry in which the attribute you specified includes, but is not necessarily limited to, the value you enter.
      Exact Match	Searches for an entry whose specified attribute is the same as the value you enter.
      Greater or Equal	Searches for an entry in which the specified attribute is numerically or alphabetically greater than or equal to the value you enter.
      Less or Equal	Searches for entries in which the specified attribute is numerically or alphabetically less than or equal to the value you enter.
      Present	Determines if an entry with the specified attribute is present at that level of the tree. You do not need to enter a value to use this relationship.

1. In the text box at the right end of the search criteria bar, type the value for the attribute you just selected. For example, if the attribute you selected was cn, you could type the particular common name you want to find.

5. To further refine your search, use the buttons in the Search Criteria box to enhance the search criteria bar.

   Button	Description
   New	Creates a new search criteria bar in the Search Criteria field. This button is enabled only when the Search Criteria field is empty.
   And	Creates another search criteria bar in the Search Criteria field. Matches all entries with one specified attribute with those that also have another specified attribute. For example, cn=Baldwins And title=Laborer retrieves all Baldwins who are also laborers.
   Or	Creates another search criteria bar in the Search Criteria field. Matches all entries with either one specified attribute or another. For example, title=Laborer Or title=Foreman retrieves all employees who are either laborers or foremen.
   Not	Negates the criterion in the selected search criteria bar and retrieves all entries that do not have the specified criterion. For example, cn=Frank And Not title=Laborer retrieves all persons named Frank who are not laborers.
   Delete	Deletes a selected search criteria bar

6. Click Search. The results of your search appear in the Distinguished Name box.
7. To view the properties of a particular audit log entry, select it in the Distinguished Name box, then click View Properties. The Audit Log Entry dialog box displays the properties for the audit log entry you selected.

   See Also: "Configuring Searches" for instructions on setting the number of entries to display in searches, and to set the time limit for searches

Searching for Audit Log Entries by Using ldapsearch

The DN for the audit log container is cn=auditlog. To search for audit log entries, perform a subtree or one-level search, with the container object cn=auditlog as the base of the search.

See: "ldapsearch Syntax"

Purging the Audit Log

You can use bulkdelete to purge audit log objects under the container cn=auditlog. Run the following command:

bulkdelete.sh -connect net_service_name -base "cn=auditlog"

Viewing Active Server Instance Information

To view information about any active directory server instance--including type, instance number, debug level, host name, and configuration parameters--use Oracle Directory Manager. To do this:

1. In the navigator pane, expand Oracle Internet Directory Servers and select a directory server. The group of tab pages for that directory server instance appear in the right pane.
2. Select the Server Management tab. This displays basic information--namely, type, instance number, debug level, and host name--for all active directory server instances.
3. To see configuration parameters for a particular directory server instance, select the directory server instance, then click View Properties. The Server Process dialog box displays configuration parameters for the directory server instance you selected. Note that you cannot change configuration parameters in this dialog box. To change them, you must change the configuration set entry on which they are based.

   See Also: "Managing Server Configuration Set Entries by Using Oracle Directory Manager" for instructions on changing configuration set entries

Changing the Password to an Oracle Database Server

The Oracle Internet Directory uses a password when connecting to an Oracle database. The default for this password when you install Oracle Internet Directory is ODS. You can change this password by using the OID Database Password Utility.

See Also: "The OID Database Password Utility"

Dereferencing Alias Entries

This section explains concepts about dereferencing alias entries, the usage model, and includes a list of messages.

This section contains these topics:

• Concepts for Dereferencing Alias Entries
• Using Alias Entry Dereferencing
• Success and Error Messages

Concepts for Dereferencing Alias Entries

Alias entries in the LDAP directory enable one entry to point to another entry, so you can devise structures that are not strictly hierarchical. Alias entries perform a function like symbolic links in the UNIX file system or shortcuts in the Windows 95/NT file system.

In Figure 5-3, the ou=uk sales,ou=global sales,o=oracle,c=us entry is an alias entry pointing to the ou=sales,o=oracle,c=uk entry. The pointer (like all information) is held as an attribute, the aliased object name attribute of the alias entry. Alias entries have special object class alias to distinguish them from object entries in a directory.

Alias Objectclass Definition

(2.5.6.1 NAME 'alias' SUP top STRUCTURAL MUST aliasedObjectName)

Aliased Objectname Definition

(2.4.5.1 NAME 'aliasedObjectName" EQUALITY distinguishedNmameMatch SYNTAX 
1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE)

Figure 5-3 Alias Entries Example

Text description of the illustration oidag065.gif

Anyone referencing ou=uk sales,ou=global sales,o=oracle,c=us is automatically rerouted to the real entry ou=sales,o=oracle,c=uk by the LDAP server. This process is called alias dereferencing.

Using Alias Entry Dereferencing

This section contains these topics:

• Adding an Alias Entry
• Searching the Base
• Searching One-Level
• Searching a Subtree
• Modifying Alias Entries

Adding an Alias Entry

Use the following LDIF to create a normal entry and an alias entry pointing to the real entry. When you add the information in the steps, the tree in Figure 5-4 is the result.

1. Create a sample.ldif file with the following entries:

   dn: c=us
   c: us
   objectclass: country
   
   dn: o=oracle, c=us
   o: oracle
   objectclass:organization
   
   dn: ou=Area1, c=us
   objectclass: alias
   aliasedObjectName: o=oracle, c=us
   
   dn: cn=John Doe, o=oracle, c=us
   cn: John Doe
   objectclass: person
   
   dn: cn=President, o=oracle, c=us
   objectclass: alias
   aliasObjectName:  cn=John Doe, o=oracle, c=us
   
   

2. Add entries to the directory using the following command:

   ldapadd -p <port> -h <host> -f  sample.ldif
   
   

   Note: When you add an alias entry whose parent is an alias entry, the LDAP server will return an error.

   See Also:  Entry Alias Dereferencing Messages for error messages

Figure 5-4 Resulting Tree when Creating the sample.ldif File

Text description of the illustration oidag064.gif

In Figure 5-4, the letter A represents an alias entry, where:

• ou=Area1 is an alias pointing to o=oracle
• cn=President is an alias pointing to cn=John Doe

Searching the Base

A base search finds the top-most level of the alias entry you specify.

For example, perform a base search of "ou=Area1,c=us" with a filter of "objectclass=*" with the -deref option LDAP_DEREF_FINDING as follows:

ldapsearch -p <port> -h <host> -b "ou=Area1,c=us"  -a find -s base 
"objectclass=*" 

The directory server, during the base search, looks up the base specified in the search request and returns it to the user if located. If the base is an alias entry and, as in the example, -a find is specified in the search request,then the LDAP server automatically dereferences the alias entry and returns the dereferenced entry. Therefore, the search dereferences ou=Area1,c=us (which is an alias entry) and o=oracle,c=us is returned.

Searching One-Level

A one-level search finds only the child to the base level you specify.

In each search you specify, there are flags you can set. The search is performed based on the flag you specify.

The flags are as follows:

Flag	Content
LDAP_DEREF_NEVER	-a never
LDAP_DEREF_FINDING	-a find

By default, the dereference flag in ldapsearch is LDAP_DEREF_NEVER (that is, -a never) and thus the LDAP server does not perform any dereferencing for alias entries.

For example, perform a one-level search of "ou=Area1,c=us" with a filter of "objectclass=*" with the -deref option set to LDAP_DEREF_FINDING (-a find) as follows:

ldapsearch -p <port> -h <host> -b "ou=Area1,c=us"  -a find -s one 
"objectclass=*"

The search operation is performed by the LDAP server in two steps.

1. The LDAP server searches for the base that is specified in the search request.
2. When the LDAP server locates the base, then it looks up all one-level entries under this base and returns entries that match the filter criteria.

In the example, -a find is specified in the search request, thus the LDAP server automatically dereferences while looking up the base (the first step), but does not dereference alias entries that are one level under the base. Therefore, the search dereferences ou=Area1,c=us (which is an alias entry) and then looks up one-level entries under o=oracle,c=us. One of the one-level entries is cn=President,o=oracle,c=us that is not dereferenced and is returned as is.

Thus, the search returns cn=President,o=oracle,c=us and cn=John Doe,o=oracle,c=us.

Searching a Subtree

A subtree search finds the base, children, grand children, (the family tree).

In each search you specify, there are flags you can set. The search is performed based on the flag you specify.

The flags are as follows:

Flag	Content
LDAP_DEREF_NEVER	-a never
LDAP_DEREF_FINDING	-a find

By default, the dereference flag in ldapsearch is LDAP_DEREF_NEVER (that is, -a never) and thus the LDAP server does not perform any dereferencing for alias entries.

For example, perform a subtree search of "ou=Area1,c=us" with a filter of "objectclass=*" with the -deref option LDAP_DEREF_FINDING as follows:

ldapsearch -p <port> -h <host> -b "ou=Area1,c=us" -a find -s one "objectclass=*" 

The search operation is performed by the LDAP server in two steps.

1. The LDAP server searches for the base that is specified in the search request.
2. When the LDAP server locates the base, then it looks up all entries under this base and returns entries that match the filter criteria.

In the example, -a find is specified in the search request, thus the LDAP server automatically dereferences while looking up the base (the first step), but does not dereference alias entries that are under the base. Therefore, the search dereferences ou=Area1,c=us (which is an alias entry) and then looks up entries under o=oracle,c=us. One of the entries is cn=President,o=oracle,c=us that is not dereferenced and is returned as is.

Thus, the search returns the following:

• o=oracle,c=us
• cn=john doe,o=oracle,c=us
• cn=President,o=oracle,c=us

Modifying Alias Entries

You can modify alias entries.

For example, create a sample.ldif file with following entries:

dn: cn=President, o=oracle, c=us
changetype : modify
replace: aliasObjectName
aliasObjectName:  cn=XYZ, o=oracle, c=us

Modify the alias entry using the following command:

ldapmodify -p <port> -h <host> -f sample.ldif

Success and Error Messages

The following messages are returned when encountering the alias issue in the description column.

Table 5-3  Entry Alias Dereferencing Messages

Message	Description
Alias Problem	The error message returns to the client when either of the following occur: An alias was dereferenced, but it did not point to an entry in the DIT. The user tries to add an alias entry whose parent is an alias.
Alias Dereferencing Problem	The error message returns to the client when the user is not allowed to dereference an alias because of access control issues.
No Such Object	The error message returns to the client when the server is not able to find the base DN specified in the search request.
Invalid DN Syntax	When adding or modifying an alias entry, if the value specified for aliasedObjectName has invalid DN syntax, then the LDAP server returns an invalidDNSyntax error message to the client.
Success	The LDAP server returns a success message when the client operation successfully completes. When the dereferenced target does exist but does not match the filter specified in the search request, the server returns a success message with no matched entry.
Insufficient Access Rights	The error message returns if the user does not have access to the dereferenced entry.