Sun ONE Directory Server 5.2 Release Notes

Sun™ ONE Directory Server 5.2 Release Notes

Version 5.2

Part Number 816-6703-10

January 2005

These release notes contain important information available at the time of release of Version 5.2 of Sun Open Net Environment (Sun ONE) Directory Server. New features and enhancements, known limitations and problems, technical notes, and other information are addressed here. Read this document before you begin using Directory Server 5.2.

The most up-to-date version of these release notes can be found at the Sun ONE documentation web site: http://docs.sun.com/doc/816-6703-10. Check the web site prior to installing and setting up your software and then periodically thereafter to view the most up-to-date release notes and manuals.

These release notes contain the following sections:

Revision History

Table 1  Revision History

Date

Description of Changes

January 07, 2005

November 17, 2004

October 11, 2004

August 30, 2004

August 23, 2004

  • Amendment of Supported Platforms to indicate that support for Microsoft Windows Server 2003 Enterprise Edition (IA-32) is restricted to the compressed archive update.

July 16, 2004

December 8, 2003

October 28, 2003

September 16, 2003

August 27, 2003

July 11, 2003

June 26, 2003

Updated issue #4882801 to specify platform

June 23, 2003

Addition of the following:

  • Note on write capability and multi-master replication
  • Note on initializing replicas in a multi-master replication scenario
  • Problem with multibyte characters at installation of Japanese version (#4882927)
  • Problem with multibyte characters in suffixes for traditional Chinese version (#4882801)
  • Note on localized documentation availability
  • Addition to Administration Guide errata

June 10, 2003

Addition of Japanese locale issue on HP-UX systems

June 6, 2003

Initial release of these release notes

About Directory Server, Version 5.2

Sun ONE Directory Server 5.2 is a powerful and scalable distributed directory server based on the industry-standard Lightweight Directory Access Protocol (LDAP). Sun ONE Directory Server software is part of Sun ONE, Sun’s standards-based software vision, architecture, platform, and expertise for building and deploying Services On Demand.

What’s New in Directory Server, Version 5.2

Sun ONE Directory Server 5.2 contains the following new features and enhancements:

Note

A master initialized from another master in a multi-master configuration will process replication updates and allow read operations, but will return referrals for all write operations from clients. To revert a master to read-write mode, set the ds5BeginReplicaAcceptUpdates configuration attribute to start to explicitly allow update operations. You should verify that the new master replica has converged with the other masters before enabling updates. The change to allow updates may be done using either the replication configuration panel on the Directory Server console or through the command line. For more information, see “Initializing Replicas” in the Sun ONE Directory Server Administration Guide.

Due to architectural changes made in Directory Server 5.2, some features that were available in Directory Server 4.x are no longer included. These are:

Supported Platforms

Directory Server 5.2 is available on the following platforms:

Note

Directory Server 5.2 has been validated with Sun Cluster 3.1.

For information on the availability of Directory Server on the Compaq Tru64 operating system, contact your Compaq representative.

Specific operating system patches or service packs may need to be installed before Directory Server 5.2 can be installed. For further information, refer to the Sun ONE Directory Server Installation and Tuning Guide. You can obtain Solaris patches from http://sunsolve.sun.com

Installation Notes

An update is available for compressed archive versions of Directory Server 5.2.

This update brings the product in line with the Directory Server product packaged with the Sun JavaTM Enterprise System 2004Q2. You will sometimes see this update referred to as the patchzip utility in the documentation. The enhancements and bug fixes available in this update are documented in the Sun Java System Directory Server 5 2004Q2 Release Notes. The update is available at http://sunsolve.sun.com with the following Patch IDs:

Localized Patch IDs are as follows:

Installation instructions for the update are provided in the README files available at this URL.

Patching compressed archive versions of Directory Server in a localized environment requires the English update utility (#5069508)

If you have installed a localized version of Directory Server via compressed archive, and are updating the installation, do the following:

  1. Run the English version of the compressed archive update utility.
  2. Extract the patch file appropriate to your locale to the directory in which Directory Server is installed (the ServerRoot directory.) Run the unzip command with the -o option (to overwrite existing files) and as the user who owns the ServerRoot directory. For example

    3. unzip -o 5.2_Patch_2-ja.zip -d ServerRoot

If you do not complete both of these steps in the correct order, the update will fail. (The unzip utility is delivered with the compressed archive update, except for Linux platforms, on which you must install the unzip utility.)

Patching compressed archive versions of Directory Server fails if Windows Event Viewer is open (#5061260)

On Windows platforms, if you have installed Directory Server via compressed archive, and are updating the installation, the update fails if Windows Event Viewer is open.

Workaround
Close the Event Viewer before launching the compressed archive update.

Patching compressed archive versions of Directory Server fails if the administration password includes special characters (#5068370)

On Windows platforms, if you have installed Directory Server via compressed archive, and are updating the installation, using certain special characters in the administration password causes the update to fail. Known special characters that cause problems include ‘&’.

Workaround 1

  1. Instead of running the install script directly, create a file (filename) containing the administration ID and password, for example:
  1. Run the following command:

Workaround 2
Change the administration password temporarily while performing the update. For information on how to change the administration password, see “To Change the Configuration Administrator’s User Name or Password” in Chapter 4 of the Administration Server Administration Guide.

Patching compressed archive versions of Directory Server fails if the administration password is longer than eight characters (#5070064)

On HP-UX, if you have installed Directory Server via compressed archive, and are updating the installation, an administration password longer than eight characters causes the update to fail.

Workaround
Change the administration password temporarily while performing the update. For information on how to change the administration password, see “To Change the Configuration Administrator’s User Name or Password” in Chapter 4 of the Administration Server Administration Guide.

The mechanism for patching compressed archive versions of Directory Server requires the unzip utility (#5057611)

On Linux platforms, if you have installed Directory Server via compressed archive, you must install the unzip utility before running the compressed archive update. (On other platforms, the unzip utility is delivered with the compressed archive update.)

The Directory Server Installation and Tuning Guide recommends that you use a Java Runtime Environment version 1.4.1 or later.

Note that the latest JRE and JDK can be downloaded from http://java.sun.com/.

With compressed archive installations, if either Administration Server or Directory Server is installed as root, uninstallation must also be run as root (#5014882).

If you do not run the uninstallation as root, the product registry is not updated correctly.

When installing in locales other than C, additional language support packages are required.

For a complete list of the packages required, see “Localized Packages for Component Products“ in the Sun Java Enterprise System 2003Q4 Installation Guide.

The Directory Server 5.2 product packaged with the Sun JavaTM Enterprise System 2003Q4 provides the following enhancements and bug fixes:

If you run Administration Server as root, all commands initiated by the administration user will also be run as root.

Therefore you must apply the same rules of confidentiality and security to the administration password as you would to the root password of your server.

The idsktune utility is up to date as at the release date of Directory Server 5.2.

Inaccuracies may therefore arise if new patches are provided after this date.

On Solaris systems, the SUNWnisu package is required for installation to succeed.

Note that the presence of SUNWnisu does not imply that you must use NIS.

Installation paths that contain space characters are not supported.

Do not use space characters in your installation path.

When installing Directory Server 5.2 from Solaris Packages, do not specify a symbolic link as the ServerRoot.

The ServerRoot is the path from which you access the shared binary files of Directory Server, Administration Server, and the command line tools. If you do specify a symbolic link as the ServerRoot, and then attempt to start the Administration Server as someone other than the root user, the following error is output:

In Directory Server 5.2, the schema file 11rfc2307.ldif has been altered to conform to rfc2307.

This file corresponds to 10rfc2307.ldif (for 5.1 zip installations) and to 11rfc23.ldif (for 5.1 Solaris packages). Applications using the deprecated 5.1 version of this schema may be affected by this change. A summary of the modifications follows:

To use SASL Kerberos authentication on Solaris platforms, you must ensure that DNS is configured.

On Linux systems, the combined configured cache values should not exceed 600MB.

IPv6 support has not been extensively tested on Windows systems.

When uninstalling Directory Server on Windows systems, be aware that certain basic system libraries used by Directory Server (nsldap32v50.dll, for example) may be used by other installed products.

You can select not to uninstall these libraries if other products are using them.

Errata and Directory Server Documentation Updates

Directory Server Resource Kit Tools Reference

Chapter 30, “Network Security Services,” references mozilla.org for documentation. The documentation on mozilla.org appears, however, to be out of date with respect to the tools provided with Directory Server Resource Kit. For example, support for public/private 2048-bit key pairs and certificates is not mentioned in that documentation.

Reference Manual

The description of the ldif2db, db2ldif, and db2ldif.pl command-line scripts in Chapter 2, “Command-Line Scripts” are inaccurate. Each of these scripts should include the following options, in addition to what is documented:

Table 2  Additional Options to ldif2db, db2ldif, and db2ldif.pl Command-Line Scripts

Option

Meaning

-Y

Specifies the password for the key database (used for attribute encryption.)

-y

Specifies the file in which the password for the key database is held (used for attribute encryption.)

Plug-In API Programming Guide

Chapter 5, Extending Client Request Handling, describes the use of Pre-Operation and Post-Operation Plug-Ins. This section should include the following note:

Note

For SASL authentication mechanisms, any bind pre-operation plug-in or post-operation plug-in may be called several times for the same authentication request. This is because multiple LDAP BIND operations may be used to implement that authentication mechanism, as is the case for DIGEST-MD5, for example.

Administration Guide

  1. Chapter 8, “Managing Replication,” states that you need to reinitialize all consumers in a topology if you disable the change log or move it to a new location. In fact, this caution applies only if there are changes that have not been replicated to other servers in the topology when the change log directory is changed. If all changes have been replicated before the change log is moved (that is, if all servers are in sync,) there is no risk associated with moving the change log directory, and no reinitialization is required.
  2. Chapter 3, “Creating Your Directory Tree,” incorrectly states that the persistent search control (OID 2.16.840.1.113730.3.4.3) can be chained. In the current Directory Server implementation, this is not the case.

    3. In addition to the persistent search control, the following controls are incorrectly exposed in the Administration Guide:

    • 2.16.840.1.113730.3.4.4 (Password expired notification)
    • 2.16.840.1.113730.3.4.5 (Password expiring notification)
    • 2.16.840.1.113730.3.4.15 (Authentication response)

      • These three controls are returned to the client by Directory Server, so are not affected by chaining configuration.

    • 2.16.840.1.113730.3.4.13 (Replication update information)

      • This control should not be used with chaining by Directory Server clients.

  3. The online version of the Administration Guide has been updated as follows:
  4. Chapter 3 of the HTML version on the CD is truncated. For the correct version of this file, consult the online version (on docs.sun.com) or download the documentation set, in HTML format.
  5. Chapter 8, Managing Replication, contains the following with regard to the replication retry algorithm:

    6. “The retry pattern is as follows: 20, 40, 80, then 160 seconds. The supplier will then retry every 160 seconds.”

    This should be:

    “The retry pattern is as follows: 20, 40, 80, 160, then 300 seconds. The supplier will then retry every 300 seconds (5 minutes).”

Installation and Tuning Guide

Appendix C - Installing Sun Cluster HA for Directory Server should include the following note:

Note

When installing and configuring the Sun Cluster HA for Directory Server data service, the Solaris packages must be installed on local, non-shared disks. In addition, the ServerRoot must be on shared or global disks.

Directory Server Resource Kit Tools Reference

  1. Although it is included in the documentation, the iPlanet LDAP Administrative Shell (ilash) is not included in the current release of the Directory Server Resource Kit (DSRK.)
  2. In Chapter 3, “ldapsearch,” the -o option of the ldapsearch command is incorrectly documented. This option does not format the output of search results so that no line breaks are used within individual attribute values, as indicated in this chapter.

    3. Instead, the -o option is used to specify the SASL options mech, realm, authid and authzid.

    For more information on these options, see “Examples of the ldapsearch Command” in Chapter 11 of the Sun ONE Directory Server Administration Guide.

    This error corresponds to bug #4784801.

General

Certain books in the documentation set identify the Directory SDKs for C and for Java as iPlanet brand products. In all instances, these should be identified as Sun ONE brand products.

Note

Localized documentation is posted to http://docs.sun.com/ as it becomes available.

Compatibility Issues

Enhancements Made and Problems Corrected

Directory Server 5.2 includes enhancements and fixes to the following known problems that occurred in earlier releases:

Replication

Console

Database

Security

Roles and Class of Service

LDAP Access

Performance

Conformance

Installation, Uninstallation and Migration

Miscellaneous

Known Issues

This section contains a list of the more important known issues at the time of the Directory Server 5.2 release. These issues are divided into the following sections:

Installation, Uninstallation, and Migration

Multibyte characters at installation cause configuration problems (#4882927)

At installation, using multibyte characters for anything other than the suffix name causes Directory Server and Administration Server configuration to fail.

Workaround
Use monobyte characters for all fields other than the suffix name.

Multibyte characters cannot be used in the suffix name during installation of the traditional Chinese (zh_TW) version (#4882801)

If multibyte characters are entered as the suffix name during installation of the traditional Chinese (zh_TW) version, the suffix name does not display correctly in the console. This issue is restricted to 32-bit and 64-bit installations from Solaris packages on SPARC processors.

Workaround

  1. Create a monobyte suffix at installation. Once installation is complete, create the desired multibyte suffix using the console.
  2. Upgrade your JRE to version 1.4.1 or later.

On HP-UX systems, when the system locale is set to Japanese, the Administration Server does not start by default (#4869632)

Workaround
Before installing using a locale other than US English, set the LANG environment variable to C, as documented in the Sun ONE Directory Server Installation and Tuning Guide. Note that this issue has been corrected in the Japanese localized version of Directory Server.

Harmless error message occurs on installation (#4820566)

After a successful installation, the following error is logged:

ERROR<5398> - Entry - conn=-1 op=-1 msgId=-1 - Duplicate value addition in attribute "aci"

This error is harmless and can be ignored.

An installation path of more than 54 characters prevents the Administration Server from starting correctly (#4788213)

Workaround
Ensure that your full installation path does not contain more than 54 characters.

Directory Server cannot be installed through Microsoft Terminal Services (#4710132)

A root suffix cannot contain spaces (#4526501)

Workaround
If your root suffix contains space characters, correct the suffix generated at installation time to remove the spaces:

  1. In the Sun ONE Server console, select the top directory entry in the left-hand navigation pane of the Servers and Applications tab.
  2. Click Edit and modify the suffix in the User directory subtree field.
  3. Click OK to save the change.

Error message with migrateInstance5 (#4529552)

When running the migrateInstance5 script with error logging disabled, a message is displayed indicating that the migration procedure is attempting to restart the server while the server is already running.

If error logging is disabled, you can ignore this error message.

If this message appears when error logging is enabled, consult the error log for more information.

Security

DNS keyword in ACIs (#4725671)

If the DNS keyword is used in an ACI, any DNS administrator can access the directory by modifying a PTR record, and can thereby provide the privileges granted by the ACI.

Workaround
Use the IP keyword in the ACI, to include all IP addresses in the domain.

Entry DNs containing quotes (#4529541)

Directory Server does not correctly parse ACI target entry DNs containing quotes. The following example causes a syntax error:

dn:o=mary\"red\"doe,o=example.com,o=isp
changetype:modify
add:aci
aci:(target="ldap:///o=mary\"red\"doe,o=example.com,o=isp")(targetattr="*")
(version 3.0; acl "test"; allow (all) userdn ="ldap:///self";)

Account lockout after password change (#4527623)

Account lockout remains in effect after a user password has been changed. If users forget their passwords and are locked out of the directory, they are unable to log in until the lockout attributes (accountUnlockTime, passwordRetryCount, and retryCountResetTime) are cleared, even if an administrator has reset their passwords.

Workaround
Reset the lockout attributes accountUnlockTime, passwordRetryCount, and retryCountResetTime to unlock the account.

Schema

nsslapd-ds4-compatible-schema attribute (#4666007)

Setting the nsslapd-ds4-compatible-schema attribute to on may cause slapd to fail to start.

This problem has been fixed for the default schema provided with Directory Server 5.2. However, the problem may still be apparent in custom schema modifications. Directory Server 4.x notation is not LDAPv3 compliant and support for this notation will be removed in a future release of Directory Server.

Workaround
For custom schema:

Replication

Replication fails after recreating schema with new OIDs (#5050755)

If you delete an attribute or object class in a user-defined schema, and then recreate it with a new OID, adding entries using this schema may cause replication to stop. This problem also occurs when an OID in a user-defined schema is changed.

Workaround
If this problem causes replication to stop, manually replace the 99user.ldif file on the consumer with the 99user.ldif on the supplier, and restart the consumer.

Additional documentation required on using referential integrity plug-in with legacy replication (#4956596)

When replicating from a 4.x master to a 5.x consumer, with referential integrity enabled, you must reconfigure the referential integrity plug-in on the 4.x master to write referential integrity changes to the 4.x changelog. This enables referential integrity changes to be replicated. If you do not reconfigure the plug-in, referential integrity will not work correctly.

To reconfigure the referential integrity plug-in in this environment:

  1. Stop the 4.x server.
  2. Open the slapd.ldbm.conf file located in ServerRoot/slapd-ServerID/config/.
  3. Locate the line that begins:
  1. Modify this line by changing the argument that appears just before the list of attributes from 0 to 1.

    2. For example, change:

  1. Save the slapd.ldbm.conf file.
  2. Restart the server.
  3. Reinitialize the 5.x consumer from the 4.x supplier.

The changelog is not purged by default (#4881004)

When configuring replication, be aware that the changelog is not purged by default. This means that the changelog.db3 files will continue to grow ad infinitum.

Workaround
Set a value for the maximum changelog age or for the maximum number of changelog records. To do this, select Configuration>Data>Replication from Directory Server Console, or modify the attributes nsslapd-changelogmaxage or nsslapd-changelomaxentries under cn=changelog5,cn=config (using the command line.) The nsslapd-changelogmaxage attribute should be set to the same value as the nsDS5ReplicaPurgeDelay attribute under cn=replica,cn=suffixName,cn=mapping tree,cn=config. For more information on these attributes, see Chapter 4, “Core Server Configuration Attributes” in the Sun ONE Directory Server Reference Manual.

The insync command-line tool has no concept of partial replication (#4856286)

Reported delays may therefore be inaccurate when partial replication is configured.

Workaround
If partial replication is configured, use the ldapsearch utility to determine the value of the ds5ReplicaPendingChangesCount attribute. This read-only attribute provides the number of changes not yet sent to the specified consumer. The attribute must be specifically requested in the ldapsearch operation. Note that an ldapsearch command on this attribute will have a performance impact on the server.

Multi-master replication over SSL (#4727672)

In a multi-master replication scenario, if replication is enabled over SSL using simple authentication, it is not possible to enable replication between the same servers over SSL using certificate-based client authentication.

Workaround
To enable replication over SSL using certificate-based client authentication, restart at least one of the servers.

Aborting a total update (#4741320)

If a total update is aborted while in progress, it is not possible to launch another total update, or to reenable replication on the suffix.

Workaround
Do not abort a total update while it is in progress.

Replication monitoring tools and literal IPv6 addresses (#4702476)

The replication monitoring tools (entrycmp, insync and repldisc) do not support LDAP URLs containing literal IPv6 addresses.

Local schema modifications may be overwritten when a consumer database is created (#4537230)

Note

The replication monitoring tools rely on read access to cn=config to obtain the replication status. This should be taken into account particularly when replication is configured over SSL.

Note

In Directory Server 5.2, the schema file 11rfc2307.ldif has been altered to conform to rfc2307. If replication is enabled between 5.2 servers and 5.1 servers, the rfc2307 schema MUST be corrected on the 5.1 servers, or replication will not work correctly. To ensure correct replication between a 5.2 server and a 5.1 server:

Initially, certain schema attributes may be replicated between the servers as they synchronize other schema elements but this is benign and will not cause any problems. See the Installation Notes for details on how the schema has changed.

Directory Server Console

The console cannot display certificates with a quotation mark (“) in the DN (#5067904)

Workaround
Use the certutil utility to view the certificates in the database.

Creating a new role via the console fails with a Java exception (#5063342)

If you have upgraded to Directory Server 5.2 Patch 2, creating a new role using the console fails with a Java exception error.

Workaround 1
Edit the Configuration Directory Server, and update the class to be called by the console, as follows:

  1. ldapsearch -1 -p CDS port -b o=Netscaperoot cn=nsroledefinition 1.1
     dn: cn=nsroledefinition, cn=ResourceEditorExtension, ou=4.0, ou=Admin, ou=Global
     Preferences, ou=administration domain, o=NetscapeRoot
  2. ldapmodify -p CDS port -D root dn -w root pw
    Result of previous command
    changetype: modify
    replace: nsclassname
    nsclassname: com.netscape.admin.dirserv.roledit.ResEditorRoleInfo@ds522.jar
    nsclassname: com.netscape.admin.dirserv.roledit.ResEditorRoleMembers@ds522.jar
    nsclassname: com.netscape.admin.dirserv.roledit.ResEditorRoleAccountPage@ds522.jar

    modifying entry cn=nsroledefinition, cn=ResourceEditorExtension, ou=4.0,
    ou=Admin, ou=Global Preferences, ou=france.sun.com, o=NetscapeRoot

    ^C
  3. Restart the console.

A side effect of this workaround may be that it is no longer possible to create a new role using the console, on a server of a different version, using the same Configuration Directory Server.

Workaround 2
Use the ldapmodify command to create the new role.

Patching compressed archive versions of Directory Server in a localized environment causes the Administration Console to display the incorrect name (#5069443)

If you have installed a localized version of Directory Server via compressed archive, and are updating the installation, the Administration Server console name changes from Sun Java System to Sun ONE. This change is harmless and can be ignored.

Creating a new group with new members (#4868083)

Creating a new group with new members through the console causes an LDAP exception error. If you create a new group through the console, and attempt to add members before saving the group, the following error is displayed:

Save Error Cannot save to directory server: netscape.ldap.LDAPException: error results (2); protocol violation: attribute uniquemember has no values; Protocol error

Workaround
Add the group and save it (by clicking OK on the Create New Group window), then add the members.

The console does not support passwords containing a colon (#4535932)

The console does not support passwords containing a colon (:).

Workaround
Do not use colons in passwords.

The console and external security devices (#4795512)

The console does not support the management of external security devices, such as Sun Crypto Accelerator 1000 Board.

Workaround
External security devices must be managed via the command line.

Trailing spaces are not preserved during a remote console import operation (#4529532)

Trailing spaces are preserved during both local console and ldif2db import operations.

Running the startconsole command with the -l option (#4843693)

On Windows systems, running the startconsole command with the -l option does not set the locale correctly. The console cannot display I18N characters unless the locale is set.

Workaround
In addition to using the -l option with the startconsole command, set the locale as follows:

  1. Select Start > Settings > Control Panel.
  2. Select Regional Options.
  3. On the General tab of the Regional Options window, select the required locale from the Your locale dropdown list.
  4. Click OK.

Core Server

Stopping the server during export, backup, restore, or index creation causes it to crash (#4678334)

Miscellaneous

DsmlSearch does not handle chunked DSML responses (#5104932)

Although Directory Server includes a configurable (ds-hdsml-responsemsgsize) response buffer size to allow chunked DSML responses, the DsmlSearch utility delivered with Directory Server Resource Kit cannot currently handle chunked DSML responses. In consequence, the DsmlSearch utility cannot handle search responses where results generated are larger than the response buffer size. For instance, a search for "objectclass=*" might result in a chunked response, causing DsmlSearch to print a stack trace. This limitation does not affect client utilities that can handle chunked DSML responses.

Statistics for SNMP subagents (#4529542)

On UNIX platforms, statistics are generated only for the last SNMP subagent that is started. This implies that you can monitor only one Directory Server instance at a time with SNMP.

Transaction logs and the db2bak command-line utility (#4815733)

Transaction logs are no longer deleted if the db2bak command-line utility is cancelled. Database transaction log removal is temporarily disabled while db2bak is running, and is not reenabled if the command terminates prematurely.

Workaround
Do not interrupt (with CTRL-C, for example) the db2bak command while a backup is in progress. To avoid this problem, it is strongly recommended that you use db2bak.pl (directoryserver db2bak-task for Solaris packages.)

The pass-through authentication (PTA) plug-in cannot be configured to accept multiple authenticating Directory Servers with the same suffix (#4845622)

Changing the maximum size of the transaction log file has no effect if log files already exist in the database directory (#4523783)

Workaround
Stop the server, modify the nsslapd-db-logfile-size attribute in the dse.ldif manually, remove all log.* files from the database directory, and restart the server.

ldapsearch on Linux systems (#4755958)

On Linux systems, an ldapsearch operation without a host name, such as

ldapsearch -D ... -w ... -h -p 389

returns an error 91 (ldap_simple_bind: Can't connect to the LDAP server - No route to host). On other platforms, an error 89 (LDAP_PARAM_ERROR) is returned. This is because on Linux systems, it is possible to resolve a host such as "-p", so the connect function attempts to do so, and fails.

Accessing Product Documentation

The online documentation files are contained on the product CD and can be accessed via a browser. In addition, you can download the entire documentation set, in HTML format.

Once you have downloaded this file, extract it to the following location:

The documentation set can then be accessed from:

or from the Directory Server Console, by selecting Documentation Home from the Help menu.

How to Report Problems and Provide Feedback

If you have problems with Sun ONE Directory Server, contact Sun customer support using one of the following mechanisms:

So that we can best assist you in resolving problems, please have the following information available when you contact support:

Sun Welcomes Your Comments

Sun is interested in improving its documentation and welcomes your comments and suggestions. Email your comments to Sun at this address:

docfeedback@sun.com

Please include the part number (816-6703-10) of the document in the subject line of your email.

Additional Sun Resources

Useful Sun ONE information can be found at the following Internet locations:

Copyright � 2004 Sun Microsystems, Inc. All rights reserved.

Sun, Sun Microsystems, the Sun logo, Solaris, Java and the Java Coffee Cup logo are trademarks or registered trademarks of Sun Microsystems, Inc. in the United States and other countries. Use of Directory Server is subject to the terms described in the license agreement accompanying it.